A procurement evidence checklist for intelligent software

This checklist is general information, not legal or procurement advice. Your contracting and compliance teams decide what applies to you.

What exactly is being claimed?

• The exact product or service name, not only the vendor name.
• The deployment: commercial cloud, government cloud, on-premises, or self-managed.
• The program or standard, and the level or impact category if there is one.
• The status: authorized, in process, or something else.
• The scope, and what is explicitly excluded.

Where is the authoritative source?

Prefer the record kept by the program or body that grants the status. A vendor's page is a claim; the program's own listing is evidence. Write down where you looked and on what date.

Why should a status never be generalised?

A vendor holding an authorization for one service does not mean its other services have it. A certification for one region does not cover another. If you cannot find the exact record, the status is unverified.

See also procurement guidance and our evidence record template.