C5 Vendor Due Diligence for the AI Agent Stack

An AI agent platform is rarely a single product. It is a chain of providers: cloud infrastructure, identity, model APIs, orchestration, vector database, monitoring, and external tools. C5-oriented vendor due diligence needs to review the chain, not just the hosting provider.

Provider Categories to Assess

• Cloud provider: compute, storage, network, managed databases, key management, regions
• Identity provider: authentication, federation, token issuance, privileged administration
• Model provider: API security, data handling, availability, retention, abuse controls
• Vector database: access control, encryption, deletion, backup, tenant isolation
• Observability provider: logs, traces, prompt payloads, incident data, retention controls
• Tool providers: Gmail, GitHub, CRM, ITSM, document management, internal API gateways

Due-Diligence Questions

AI-Specific Review Points

• Whether prompts and outputs are retained by the provider
• Whether customer data is used for model training or service improvement
• Whether logs can contain sensitive prompts, retrieved context, or tool outputs
• Whether per-tenant isolation is technical, logical, contractual, or a mix
• Whether the provider supports customer-managed keys or regional controls where required

Map Provider Risk to Agent Capability

Not every provider carries the same risk. A model used for public marketing copy has a different profile than a model used by an agent with access to confidential customer records and write access to business systems. Rate vendor criticality by the agent capabilities they support.

Bottom Line

C5 vendor due diligence for AI agents must follow the actual execution path of the agent. If a provider can authenticate, authorize, store, retrieve, generate, observe, or execute part of the workflow, it belongs in the third-party risk review.