What Should Contractors Review in CISA’s AI Procurement Guidance?

CISA’s guidance says buyers should look beyond general enterprise compliance and evaluate how a supplier secures the product itself. The Secure by Demand Guide explains that organizations should focus on product security, not only the manufacturer’s enterprise security, and that they can raise these questions before procurement, build product-security requirements into contract language during procurement, and continue assessing outcomes after award. CISA’s Connected Communities guidance adds that SLTT officials can ask vendors about cybersecurity risk management, incident response, data protection and privacy, and supply chain risk management for internet-connected technologies, including artificial intelligence, 5G, cloud, and IoT. The vendor questions are concrete: how risks are identified and mitigated, how products are tested before and after deployment, how incidents are detected and handled, what data is collected and how it is stored or encrypted, and how third-party suppliers and component vulnerabilities are checked. CISA also says customer organizations can use the Secure by Demand guidance in discussions with third-party resellers or service providers.