Assessment questionnaire for measuring maturity. Answer each question honestly based on current, implemented practices.
Source of truth:
../practices/EG-Vendors-OnePager.md| Canonical framing:../HAIAMM-v3.0-Framing.md§8 / §12
Practice: Education & Guidance (EG) Domain: Vendors Purpose: Assess organizational maturity in building AI-vendor literacy for the entire workforce (shadow AI reduction as the primary L1 cultural outcome) and deep practitioner skills for the intake reviewer population (Security, Procurement, Legal/Privacy, TPRM) performing AI-vendor reviews, with consistent reviewer calibration on training-data posture, DPA adequacy, model provenance, and EU AI Act deployer duties. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)
| Score | Label | Criteria |
|---|---|---|
| 1.0 | Fully Mature | Evidence complete AND ≥3 outcome metrics meet targets |
| 0.67 | Implemented | Evidence complete AND 2 outcome metrics meet targets |
| 0.33 | Partial | Evidence partially complete OR <2 outcome metrics meet targets |
| 0.0 | Not Implemented | No evidence of the activity in place |
Objective: Deliver foundational AI-vendor literacy to ≥95% of the workforce and role-based AI-vendor-review training to 100% of intake reviewer roles, with an active shadow AI awareness campaign.
Q1.1: Do you have a current-year AI-vendor literacy course (≤20 minutes) completed by ≥95% of all employees, covering what counts as an AI vendor (including AI-embedded SaaS), the AUP five rules, how to submit intake, the amnesty path, how to recognize AI features quietly enabled inside existing tools, and a before-you-paste decision aid, with content updated quarterly as the AI vendor landscape and the sanctioned catalog change?
Evidence Required: - [ ] LMS module published covering what counts as an AI vendor: consumer GenAI, AI-embedded SaaS (including inside already-approved vendors), AI coding assistants, AI APIs, AI agent platforms, with concrete examples employees recognize - [ ] AUP five-rule summary included: approved catalog, prohibited data classes, personal-account prohibition, output-review duty, disclosure obligation - [ ] Intake submission instructions included: one URL, one form, one SLA; fast-track path for parent vendors already approved; amnesty path with named owner - [ ] Recognizing AI features inside existing tools module: gallery of common SaaS AI activations (Notion AI, Slack AI, Zoom AI Companion, M365 Copilot, Gemini in Workspace) with instruction on whether approval covers the new AI feature - [ ] Before-you-paste decision aid: 10-second check for regulated, confidential, or customer-identifying data - [ ] LMS completion report showing current-year completion rate across all-employee headcount - [ ] Named training content owner with documented quarterly review cadence
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % workforce with current-year AI-vendor literacy completion | ___% | ___% | ≥95% | ☐ | |
| % intake reviewers with completed role-based training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta across reviewers on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg DPA-clause diffs per sample | ___ | ___ | ≤2 per sample | ☐ |
Metric Collection Guidance:
- Workforce literacy completion: LMS current-year completion report filtered to all-employee headcount. Formula: completed_count / total_headcount × 100
- Reviewer training completion: LMS report filtered to the intake-approval-permissions group (Security, Procurement, Legal/Privacy, TPRM). 100% is a pass/fail gate; intake-approval permissions are provisioned only after training completion.
- Calibration drift, tier: Quarterly exercise where reviewers independently score the same sample AI-vendor intake. Record each reviewer's risk-tier assignment; calculate mean absolute deviation. Source: calibration debrief facilitator record.
- Calibration drift, DPA-clause diffs: Same exercise; count DPA-clause requirement determinations that differ from the facilitated consensus per reviewer per sample; average across reviewers.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No AI-vendor literacy training in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q1.2: Has the intake reviewer population (Security, Procurement, Legal/Privacy, TPRM) completed a hands-on role-based training module (~2 hours) covering reading an AI vendor's training-data posture, DPA and AI addendum adequacy, model provenance and subprocessor chain, EU AI Act deployer duties (Art. 26/Art. 50), the priority compliance map, and the risk-tier rubric, with completion gated on intake-approval permissions and calibration drift inside target for two consecutive quarters?
Evidence Required: - [ ] Reviewer training module published covering training-data posture: default training behavior, opt-out availability, retention, fine-tuning/eval use, embeddings persistence, verification in DPA and product docs, not just vendor website - [ ] DPA and AI addendum adequacy module: required clauses (no-train commitment, subprocessor disclosure, data residency, incident notification SLA, deletion on termination), common deficiencies, redlining methodology - [ ] Model provenance and subprocessor chain module: who actually runs inference (vendor-hosted vs. Azure/GCP/AWS vs. open-model-on-vendor-infra), how the chain changes regulatory posture - [ ] EU AI Act deployer duties module: Art. 26 checklist (instructions for use, human oversight assignment, monitoring, logging, affected-persons disclosure, FRIA triggers); Art. 50 transparency obligations applied to the vendor in review - [ ] Risk-tier rubric and fast-track path module: classification criteria; when not to fast-track; how to apply the priority compliance map to a given vendor - [ ] Calibration exercise included: 3 sample intakes scored independently; facilitated debrief on tier and DPA-clause deltas - [ ] Completion gating enforced; calibration records from two consecutive quarters showing drift inside target (≤1 tier step, ≤2 DPA-clause diffs per sample)
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % intake reviewers with completed role-based training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg DPA-clause diffs per sample | ___ | ___ | ≤2 per sample | ☐ | |
| Reviewer throughput, intakes closed per reviewer per week (post-training trend) | ___ | ___ | trending up | ☐ |
Metric Collection Guidance: - Reviewer training completion: LMS completion report filtered to intake-reviewer role group. Source: LMS + access-control system confirming permissions are gated on training. - Calibration drift, tier: Independent scoring of shared sample AI-vendor intakes; mean absolute tier deviation across reviewer cohort. Source: quarterly calibration debrief facilitator records. - Calibration drift, DPA-clause diffs: Count of DPA-clause requirement discrepancies per sample versus facilitated consensus; averaged across reviewers. Source: calibration debrief records. - Reviewer throughput: AI-vendor intake queue analytics, intakes closed per reviewer per week before and after training rollout. Source: intake queue system.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No role-based reviewer training in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q1.3: Is a shadow AI awareness campaign running as an always-on communications program, not a one-time rollout, with at least monthly content, a visible amnesty path linked from the AUP and intake form, measurable attribution of intake submissions and amnesty disclosures to campaign channels, and deployer-duty micro-content for every regulated or customer-facing AI vendor use case active in the inventory?
Evidence Required: - [ ] Campaign launch documented: executive sponsor message naming shadow AI, amnesty window announced, sanctioned catalog published - [ ] Monthly content cadence evidenced: at least one piece per month (new vendor approved, fast-track win, anonymized intake catch with employee permission, external incident reframed as "could we trace this here?") - [ ] "Is this AI?" series documented: periodic call-outs of AI features quietly enabled in known SaaS; instruction on whether the existing parent approval covers it - [ ] Amnesty path linked from the AUP document, the intake form, and the sanctioned catalog page, not buried - [ ] Campaign channel URLs tagged for attribution; intake-queue referrer-source field populated showing campaign attribution rate - [ ] Deployer-duty micro-content (human oversight, logging, disclosure obligations) deployed for every regulated or customer-facing AI vendor use case active in the inventory - [ ] Feedback channel for employee AI tool nominations with visible triage; nominations acknowledged within 5 BD
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Shadow AI disclosures per quarter (amnesty path, intake queue tagged "amnesty") | ___ | ___ | rises Q1–Q2 then trends down | ☐ | |
| Intake submission volume attributable to campaign channels | ___% | ___% | ≥30% of net-new intakes | ☐ | |
| % workforce with current-year AI-vendor literacy completion | ___% | ___% | ≥95% | ☐ | |
| Campaign content cadence met | ___ | ___ | ≥1 piece/month | ☐ |
Metric Collection Guidance: - Shadow AI disclosures: Count of intake submissions tagged "amnesty" per quarter. Expect increase in Q1–Q2 post-launch (awareness working) and decrease thereafter (sanctioned catalog adoption reducing shadow AI). Source: intake queue analytics. - Campaign attribution: Percentage of net-new AI-vendor intake submissions arriving via tagged campaign channel links or form-referrer fields. Source: intake queue referrer field; UTM tracking or equivalent. - Workforce literacy completion: Same methodology as Q1.1. Shared metric. - Content cadence: Count of published shadow AI content pieces per calendar month. Source: content calendar or publication log.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No campaign running)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Objective: Move from foundational literacy to scenario-based reviewer training with depth calibrated per AI-vendor risk tier, and ship targeted training to product and engineering teams building on AI vendors.
Q2.1: Is there a scenario library of ≥30 anonymized real AI-vendor intake cases powering reviewer training across the org's in-scope vendor archetypes, with paired calibration exercises showing Critical-tier drift ≤1 tier step and ≤1 DPA-clause diff per sample for two consecutive quarters, including a practitioner capstone requiring three live end-to-end intakes under a senior-reviewer shadow?
Evidence Required: - [ ] Scenario library of ≥30 scenarios documented, each with as-submitted vendor description, original reviewer decisions (tier, DPA/AI-addendum requirements, disagreements), and resolved outcome - [ ] Scenarios organized per vendor archetype (inference-API vendors, AI-embedded SaaS, AI coding assistants, AI agent platforms) and per Critical/Medium/Low tier weighting - [ ] Paired calibration exercises in place: two reviewers score the same scenario independently; debrief facilitated on tier delta and DPA-clause requirement deltas - [ ] Critical-tier calibration drift records for two consecutive quarters showing ≤1 tier step and ≤1 DPA-clause diff per sample - [ ] Practitioner capstone in place: reviewers run three live intakes end-to-end with a senior-reviewer shadow - [ ] Scenario library reviewed quarterly with retirement criteria for stale scenarios documented
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Reviewer calibration drift on Critical-tier scenarios, avg tier delta | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios, avg DPA-clause diffs | ___ | ___ | ≤1 per sample | ☐ | |
| % Critical/High-tier integrations with ≥1 team member trained on product-team track | ___% | ___% | 100% | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ |
Metric Collection Guidance:
- Critical-tier calibration drift: Quarterly calibration exercise focused on Critical-tier AI vendor scenarios. Record tier assignments and DPA-clause requirements from each reviewer independently; calculate mean absolute deviation. Source: calibration debrief facilitator records.
- Product-team track coverage: LMS completion records for product-team AI-vendor track cross-referenced against integration registry Critical/High-tier integrations. Formula: integrations_with_trained_member / total_Critical_High_integrations × 100
- Content freshness: LMS content-management change log; count modules updated within the last 90 days.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No scenario library in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q2.2: Has a distinct training track been delivered to product and engineering teams that build on AI vendors, covering EU AI Act Art. 26 deployer duties, Art. 50 disclosure in UX, output-integrity patterns, kill-switch design, and logging obligations, paired with SA reference-pattern walkthroughs, with ≥1 trained member per Critical/High-tier AI vendor integration?
Evidence Required: - [ ] Product/engineering team training track developed: EU AI Act Art. 26 deployer-duty walkthroughs (instructions for use, human oversight assignment, monitoring, logging, affected-persons disclosure, FRIA triggers), Art. 50 disclosure in UX (compliant vs. non-compliant disclosure patterns) - [ ] Output-integrity patterns module: what output-integrity means for a vendor-supplied AI capability; how to test for regression; how to log vendor AI outputs for auditability - [ ] Kill-switch design module: what a tested kill-switch for a vendor AI integration looks like at the engineering level; how to confirm it in DR and IR - [ ] Logging obligations module: what logs must be retained, for how long, and what format is required to satisfy deployer-duty requirements - [ ] Each module paired with the SA reference pattern for the relevant AI vendor archetype - [ ] Mandatory enrollment: any team owning a Critical or High-tier AI vendor integration must have ≥1 trained team member - [ ] LMS completion records cross-referenced with integration registry showing ≥1 trained member per Critical/High-tier integration
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % Critical/High-tier integrations with ≥1 team member trained on product-team track | ___% | ___% | 100% | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ | |
| Shadow AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ |
Metric Collection Guidance:
- Product-team track coverage: LMS module completion records filtered to product-team AI-vendor track modules joined against integration registry by owning team. Formula: integrations_with_trained_member / total_Critical_High_integrations × 100
- Workforce literacy maintained: Ongoing LMS current-year completion rate; same methodology as Q1.1.
- Campaign behavior-target achievement: For each behavior-driven campaign, record whether post-campaign measurement met the pre-set target. Formula: campaigns_meeting_target / total_campaigns × 100
- Content freshness: LMS content management change log; modules with last-updated date within 90 days.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No product-team AI-vendor training in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q2.3: Are shadow AI campaigns running on a seasonal, behavior-driven cadence tied to observed risk windows (year-end OKR rush, hiring surges, post-industry-incident moments), with pre-measured behavior targets, post-campaign measurement, ≥70% of campaigns hitting their target, and ≥80% of training content updated in the last 90 days?
Evidence Required: - [ ] At least 2 behavior-driven campaigns run in the last 12 months, each with a documented pre-measured behavior target (e.g., "reduce unsanctioned ChatGPT egress from engineering by 40% in Q3") - [ ] Post-campaign measurement records for each campaign showing whether the behavior target was met - [ ] Campaign scheduling aligned to observed shadow AI risk windows (OKR-planning season, hiring surges, post-external-incident moments) - [ ] Amnesty windows running alongside campaigns; disclosure volume and source attributed to campaign channels - [ ] Campaign redesign process: campaigns missing behavior targets by >20% are redesigned - [ ] Content change log showing ≥80% of training modules updated in last 90 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Shadow AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns hit target | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios | ___ | ___ | ≤1 tier step, ≤1 DPA-clause diff | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ |
Metric Collection Guidance: - Campaign behavior-target achievement: Post-campaign measurement comparing pre-campaign baseline to post-campaign state (e.g., egress analytics, intake queue new-submission volume, amnesty disclosure volume). Source: endpoint DLP analytics, intake queue analytics, or equivalent. - Content freshness: LMS content management change log; count modules with last-updated date in the 90-day window preceding assessment date. - Calibration drift: Same methodology as Q2.1. - Workforce literacy: Same methodology as Q1.1.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No behavior-driven campaigns in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Objective: Operate continuous calibration at scale, publish the AI-vendor reviewer curriculum and rubric as an industry-shared artifact, and contribute to emerging AI-vendor reviewer certification pathways.
Q3.1: Has the AI-vendor reviewer curriculum, anonymized scenario library, reviewer rubrics, and assessment harness been published externally (CSA AI Safety Initiative, OpenSSF AI, Shared Assessments AI-vendor track, or sector ISAC) with documented adoption, citations, forks, or direct acknowledgment, and do external community contributions loop back into internal content?
Evidence Required: - [ ] AI-vendor workforce literacy module published externally under permissive license or consortium deliverable (learning objectives, assessment questions, reference-card template) - [ ] Reviewer training curriculum published externally (module outlines, DPA adequacy review methodology, EU AI Act deployer duties checklist, risk-tier rubric) - [ ] Anonymized scenario library published (scenario format, per-archetype examples, calibration debrief format) - [ ] Reviewer rubric published (tier-assignment criteria, DPA-clause adequacy scoring, Art. 26/50 deployer-duty scoring, SR-gap-list completeness scoring) - [ ] External adoption evidence: citations, forks/downloads, direct adoption acknowledgment from ≥1 other organization - [ ] Community contributions welcomed; process documented for external contributions to flow back into internal content within 30 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| External adoption, citations, forks, downloads of curriculum/scenario library/rubric artifacts | 0 | ___ | tracked, trending up | ☐ | |
| % Critical-tier reviewers holding an external AI-vendor reviewer credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| Live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| Contributions to industry certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ |
Metric Collection Guidance:
- External adoption: Repository fork/download counts; citation tracker (Google Scholar, CSA, Shared Assessments publication references); direct outreach acknowledgment records. Tracked quarterly.
- External credentials: HR credential registry cross-referenced with Critical-tier AI-vendor reviewer list. Credentials in scope: Shared Assessments AI-vendor reviewer, CSA AI Safety Ambassador, ISACA AI Audit/AI Risk, ISC2 AI-related credentials where they exist. Formula: credentialed_Critical_tier_reviewers / total_Critical_tier_reviewers × 100
- Live calibration cadence: Calendar entries confirming monthly calibration rounds; facilitator sign-off records per round.
- Industry contributions: Contribution log; each entry includes contribution type, working group name, submission date, acceptance or publication status.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No external publication in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q3.2: Is a monthly live calibration cadence operating, each round using a current anonymized AI-vendor intake from the live queue, independent reviewer scoring of tier/DPA-requirements/Art.26-duties, drift reported to the program sponsor, with calibration results feeding the scenario library within 30 days and ≥50% of Critical-tier reviewers holding an external credential where one exists?
Evidence Required: - [ ] Monthly calibration calendar entries confirmed for last 12 months (or since L3 initiation) - [ ] Per-round calibration records: anonymized vendor intake used, reviewer cohort, independent scoring results, drift calculation, facilitator debrief notes - [ ] Drift reported to program sponsor each month with trend over last quarter - [ ] Process documented and evidenced for adding new scenarios to the library within 30 days of calibration rounds revealing drift - [ ] Individual reviewer coaching records for reviewers with persistent drift on specific vendor archetype types (individual drift as development signal, not performance metric) - [ ] Credential registry showing ≥50% of Critical-tier AI-vendor reviewers credentialed where external credentials exist
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| % Critical-tier AI-vendor reviewers holding external AI-vendor reviewer credential | 0% | ___% | ≥50% (where credential exists) | ☐ | |
| Calibration results feeding scenario library within 30 days (% of drift-revealing rounds actioned) | ___% | ___% | 100% | ☐ | |
| Contributions to industry certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ |
Metric Collection Guidance: - Live calibration cadence: Program operations calendar; facilitator sign-off records per round. Count calendar months with a completed calibration round in the last 12 months. - External credentials: HR credential registry; count of Critical-tier AI-vendor reviewers with recognized credential divided by total Critical-tier reviewer count. - Scenario library pipeline: Change log of scenario library; count calibration rounds where drift was identified; count of those rounds resulting in a new scenario added within 30 days. - Industry contributions: Contribution log maintained by program lead.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No continuous live calibration in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q3.3: Does the program contribute ≥2 substantive artifacts per year to industry AI-vendor reviewer certification or curriculum working groups (Shared Assessments, CSA, ISACA, ISC2, sector-specific ISAC credentials), aligning the internal reviewer capstone with certification-grade rubrics and supporting reviewers pursuing external credentials?
Evidence Required: - [ ] At least 2 substantive contributions per year to industry AI-vendor reviewer certification or curriculum working groups, documented with contribution artifact, working group name, and date - [ ] Org's internal reviewer capstone aligned with certification-grade rubrics where external AI-vendor reviewer credentials exist - [ ] Reviewer external-credential pursuit supported: study resources, exam fee reimbursement, time allocation policy - [ ] Process documented for external working-group outputs to update internal curriculum within 30 days - [ ] External contributions traceable back to internal content, what is published externally matches what reviewers use internally
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Contributions to industry AI-vendor reviewer certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ | |
| % Critical-tier reviewers holding external credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| External adoption of curriculum artifacts (citations, forks, downloads) | 0 | ___ | tracked, trending up | ☐ | |
| Live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ |
Metric Collection Guidance: - Industry contributions: Contribution log maintained by program lead; each entry includes contribution type, working group name, submission date, acceptance or publication status. - External credentials: Same methodology as Q3.2. - External adoption: Repository analytics, citation tracker, Shared Assessments / CSA acknowledgment records. Trend tracked quarterly. - Live calibration cadence: Same methodology as Q3.2.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No industry certification contributions)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
| Level | Q1 | Q2 | Q3 | Avg | Level Achieved? |
|---|---|---|---|---|---|
| L1 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L2 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L3 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
Practice Maturity Statement:
The organization's EG-Vendors practice is at Level ___ with an average score of ___.
Document Version: HAIAMM v3.0 Practice: Education & Guidance (EG) Domain: Vendors Last Updated: 2026-05-15 Author: Verifhai
Instructions: