CISO Playbook: Run AI Vendor Assessments and Negotiate Residency‑Strict Contracts in 30 Days (Audit‑Ready)

```yaml
ledger:
  id: "ai-vendor-residency-2025Q1"
  owner: security.governance@company.com
  reviewers:
    - name: "CISO"
      email: ciso@company.com
    - name: "Deputy GC, Privacy"
      email: privacy.gc@company.com
    - name: "Head of Procurement"
      email: sourcing@company.com
  jurisdictions:
    - EU
    - UK
    - CA
  data_classes:
    - PII
    - Customer Support Content
    - Contracts/Legal Docs
  use_cases:
    - "Support Copilot Drafting"
    - "Document Intelligence (Contracts)"
  vendors:
    - name: "Vendor A LLM Gateway"
      region_claims: ["eu-west-1", "eu-central-1"]
      training_on_client_data: false
      endpoints:
        inference: "api.vendor-a.eu-west-1.example.com"
        healthcheck: "status.vendor-a.eu-west-1.example.com"
      network:
        private_link: true
        public_egress_blocked: true
      encryption:
        in_transit: "TLS1.3"
        at_rest: "AES-256-GCM"
        byok:
          provider: "AWS KMS"
          key_arn: "arn:aws:kms:eu-west-1:111122223333:key/abcd-ef01-2345-6789"
          hsm_backed: true
      telemetry:
        prompt_logging: enabled
        prompt_redaction: pii_partial
        retention_days: 30
      access_controls:
        sso: "SAML"
        rbac: ["Reader","Approver","Admin"]
        least_privilege_review_cadence: "30d"
      subprocessors:
        allowed_regions: ["EU"]
        list_url: "https://vendor-a.example.com/subprocessors"
      contract:
        dpa_signed: pending
        sccs: "2021-EU-Std-Clauses-Module2"
        residency_clause: "Data processed and stored exclusively in EU regions. No transfers without prior written authorization."
        training_clause: "Vendor prohibited from training on Client Data."
        audit_rights: "SOC2/ISO reports + on-site audit with 30d notice"
      testing:
        egress_test:
          method: "pcap + flow logs"
          result: "pass"
          evidence: "s3://evidence/eu-west-1/egress_test_2025-01-07.json"
        endpoint_dns_resolves_to:
          - "52.218.10.44 (eu-west-1)"
        traceroute_hops: 7
      approvals:
        security_review: approved
        privacy_review: approved
        legal_review: conditional
      risk:
        score: 13
        scale: "0(low)-25(high)"
        mitigations:
          - "Tighten residency clause with penalties"
          - "Add deletion SLA: 7 days"
      go_no_go: "GO - Conditional on DPA redlines accepted"
    - name: "Vendor B SaaS Copilot"
      region_claims: ["westeurope"]
      training_on_client_data: null
      endpoints:
        inference: "api.vendor-b.ai"
      network:
        private_link: false
        public_egress_blocked: false
      encryption:
        in_transit: "TLS1.2"
        at_rest: "AES-256"
        byok:
          provider: null
      telemetry:
        prompt_logging: disabled
      contract:
        dpa_signed: no
      testing:
        egress_test:
          method: "http proxy"
          result: "fail"
      risk:
        score: 22
      go_no_go: "NO-GO - Residency and telemetry insufficient"
  sla:
    evidence_freshness_days: 7
    anomaly_thresholds:
      residency_drift: 1 # any non-EU log sink triggers alert
      unauthorized_role_creations: 0
  notifications:
    slack_channel: "#ai-governance"
    escalation:
      - role: "CISO"
        within_minutes: 60
      - role: "GC"
        within_minutes: 120
```

{
  "title": "CISO Playbook: Run AI Vendor Assessments and Negotiate Residency‑Strict Contracts in 30 Days (Audit‑Ready)",
  "published_date": "2025-11-11",
  "author": {
    "name": "Michael Thompson",
    "role": "Head of Governance",
    "entity": "DeepSpeed AI"
  },
  "core_concept": "AI Governance and Compliance",
  "key_takeaways": [
    "Move from ad‑hoc DPIAs to a 30‑day, audit‑ready vendor assessment and negotiation motion.",
    "Bake data residency into runtime controls: RBAC, prompt logging, region‑locked endpoints, BYOK/HSM.",
    "Negotiate DPAs/SCCs with pre‑baked redlines tied to technical realities (KMS, egress controls, retention).",
    "Automate evidence: decision ledger, approval workflow, and residency telemetry for audits.",
    "Pilot safely in sub‑30 days with VPC/on‑prem options and never training on client data."
  ],
  "faq": [
    {
      "question": "How do we validate a vendor’s EU‑only claim?",
      "answer": "Require region‑specific endpoints, run traceroute and packet captures during test calls, verify log sinks and backups, and confirm PrivateLink/ExpressRoute/VPC‑SC. Capture evidence in the decision ledger."
    },
    {
      "question": "Can we pilot before the DPA is signed?",
      "answer": "Yes—under a conditional pilot with restricted data classes, kill‑switch, human‑in‑the‑loop, and residency telemetry enabled. Document conditions and time box the pilot."
    },
    {
      "question": "What if our business needs a model the vendor won’t run in region?",
      "answer": "Use a customer‑hosted LLM gateway in your VPC, host embeddings/vector index in region, or run an on‑prem batch mode. Negotiate a roadmap, but don’t compromise residency in production."
    }
  ],
  "business_impact_evidence": {
    "organization_profile": "Global fintech processing EU and US customer data across 6 business units; AWS + Snowflake + Salesforce stack.",
    "before_state": "Ad‑hoc AI vendor reviews took 58–90 days; unclear residency posture; 3 open DPIA escalations; pilots blocked by Legal.",
    "after_state": "Standard decision ledger + DPA/SCC redlines deployed; EU‑region VPC pilot live with BYOK and PrivateLink; weekly residency telemetry brief; auditors received a complete evidence pack.",
    "metrics": [
      "Contract cycle time reduced from 67 to 32 days (52% faster).",
      "380 legal/security hours returned in Q1.",
      "Open residency‑related audit findings from 3 to 0.",
      "Zero cross‑border data egress incidents in first 90 days."
    ],
    "governance": "Approval hinged on region‑locked endpoints, BYOK with HSM, RBAC with SSO/SCIM, prompt/content logging with 30‑day retention, documented DPIA, SCCs tied to actual flows, and a contractual prohibition on training with client data."
  },
  "summary": "CISOs: standardize AI vendor assessments and residency‑strict contracts in 30 days—evidence automated, redlines pre‑negotiated, and pilots that pass audit."
}