![](media/image21.jpg){width="2.5077438757655295in"
height="1.7291666666666667in"}

**VENDOR DUE DILIGENCE INTAKE FORM**

**Automated Self-Service Assessment**

**Purpose:** This form collects your organization\'s requirements to
generate a customized due diligence package and risk assessment.

**Completion Time:** 15-20 minutes

**Output:** Upon submission, you will receive:

-   Customized due diligence package

-   Pre-populated risk assessment

-   Relevant compliance documentation

-   Contract templates appropriate for your requirements

**SECTION 1: YOUR ORGANIZATION**

**1.1 Company Information**

**Organization Name:** \*\
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Primary Contact Name:** \*\
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Primary Contact Email:** \*\
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Primary Contact Phone:**\
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Job Title/Role:** \*\
☐ Procurement / Vendor Management\
☐ Information Security / CISO Office\
☐ Compliance / Risk Management\
☐ Legal / General Counsel\
☐ IT / Technology\
☐ Business / Operations\
☐ Executive Leadership\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Organization Headquarters Country:** \*\
☐ United States\
☐ United Kingdom\
☐ Germany\
☐ France\
☐ Other EU Member State: \_\_\_\_\_\_\_\_\_\_\_\_\
☐ Canada\
☐ Australia\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**1.2 Industry Classification**

**Primary Industry:** \*

☐ **Financial Services**\
☐ Bank (Commercial/Retail)\
☐ Bank (Investment)\
☐ Credit Union\
☐ Insurance Company\
☐ Asset Management / Investment Adviser\
☐ Broker-Dealer\
☐ FinTech / Payments\
☐ Other Financial Services: \_\_\_\_\_\_\_\_\_\_\_\_

☐ **Healthcare**\
☐ Hospital / Health System\
☐ Health Insurance / Payer\
☐ Pharmaceutical / Life Sciences\
☐ Medical Device Manufacturer\
☐ Healthcare IT / Digital Health\
☐ Other Healthcare: \_\_\_\_\_\_\_\_\_\_\_\_

☐ **Technology**\
☐ Software / SaaS\
☐ Cloud Services\
☐ AI / Machine Learning\
☐ Other Technology: \_\_\_\_\_\_\_\_\_\_\_\_

☐ **Government / Public Sector**\
☐ Federal Government\
☐ State / Local Government\
☐ Education (Public)\
☐ Other Public Sector: \_\_\_\_\_\_\_\_\_\_\_\_

☐ **Other Industry**\
☐ Manufacturing\
☐ Retail / Consumer\
☐ Energy / Utilities\
☐ Telecommunications\
☐ Professional Services\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_

**1.3 Organization Size**

**Number of Employees:** \*\
☐ 1-50\
☐ 51-250\
☐ 251-1,000\
☐ 1,001-5,000\
☐ 5,001-10,000\
☐ 10,001-50,000\
☐ 50,001+

**Annual Revenue (USD):** \*\
☐ \< \$10 million\
☐ \$10-50 million\
☐ \$50-250 million\
☐ \$250 million - \$1 billion\
☐ \$1-10 billion\
☐ \> \$10 billion\
☐ Prefer not to disclose

**Publicly Traded?** \*\
☐ Yes - Exchange: \_\_\_\_\_\_\_\_\_\_\_\_\
☐ No - Privately held\
☐ No - Government/Non-profit

**SECTION 2: REGULATORY ENVIRONMENT**

**2.1 Primary Regulators**

**Which regulators oversee your organization?** \* (Select all that
apply)

**U.S. Financial Regulators:**\
☐ Office of the Comptroller of the Currency (OCC)\
☐ Federal Reserve Board\
☐ Federal Deposit Insurance Corporation (FDIC)\
☐ Securities and Exchange Commission (SEC)\
☐ Financial Industry Regulatory Authority (FINRA)\
☐ Consumer Financial Protection Bureau (CFPB)\
☐ State Banking Regulators\
☐ State Insurance Regulators\
☐ National Credit Union Administration (NCUA)

**U.S. Healthcare Regulators:**\
☐ Department of Health and Human Services (HHS) / OCR (HIPAA)\
☐ Food and Drug Administration (FDA)\
☐ State Health Departments

**U.S. Other:**\
☐ Federal Trade Commission (FTC)\
☐ State Attorneys General\
☐ Other U.S. Regulator: \_\_\_\_\_\_\_\_\_\_\_\_

**International:**\
☐ European Data Protection Authorities (GDPR)\
☐ UK Information Commissioner\'s Office (ICO)\
☐ Other International: \_\_\_\_\_\_\_\_\_\_\_\_

☐ None of the above / Not directly regulated

**2.2 Compliance Requirements**

**Which compliance frameworks apply to your organization?** \* (Select
all that apply)

**Data Protection & Privacy:**\
☐ GDPR (EU General Data Protection Regulation)\
☐ CCPA/CPRA (California Consumer Privacy Act)\
☐ HIPAA (Health Insurance Portability and Accountability Act)\
☐ GLBA (Gramm-Leach-Bliley Act)\
☐ State Privacy Laws (Virginia, Colorado, Connecticut, etc.)\
☐ Other Privacy: \_\_\_\_\_\_\_\_\_\_\_\_

**Financial Services:**\
☐ SOX (Sarbanes-Oxley Act)\
☐ PCI DSS (Payment Card Industry)\
☐ Basel III/IV\
☐ FFIEC Guidelines\
☐ SR 11-7 (Model Risk Management)\
☐ Bank Secrecy Act (BSA) / AML\
☐ Fair Lending (ECOA, Fair Housing Act)\
☐ NYDFS Cybersecurity (23 NYCRR 500)\
☐ Other Financial: \_\_\_\_\_\_\_\_\_\_\_\_

**AI-Specific:**\
☐ EU AI Act\
☐ NIST AI Risk Management Framework\
☐ NYC Local Law 144 (Automated Employment Decisions)\
☐ Colorado AI Act\
☐ Other AI Regulation: \_\_\_\_\_\_\_\_\_\_\_\_

**Security Frameworks:**\
☐ NIST Cybersecurity Framework\
☐ ISO 27001\
☐ CIS Controls\
☐ FedRAMP (if government)\
☐ Other Security: \_\_\_\_\_\_\_\_\_\_\_\_

**2.3 Examination History**

**Has your organization been examined by regulators in the past 24
months?** \*\
☐ Yes\
☐ No\
☐ Examination pending

**If yes, did examiners review third-party/vendor risk management?**\
☐ Yes - No findings related to TPRM\
☐ Yes - Findings related to TPRM (we have enhanced our program)\
☐ No - TPRM not reviewed\
☐ N/A

**SECTION 3: INTENDED USE OF PHASE MIRROR**

**3.1 Services of Interest**

**Which Phase Mirror services are you evaluating?** \* (Select all that
apply)

**Platform (SaaS):**\
☐ Phase Mirror Oracle Platform

-   Tier interested: ☐ Team (\$6K/yr) ☐ Business (\$36K/yr) ☐ Enterprise
    > (Custom)

**Compliance Packs:**\
☐ AI Governance Essentials\
☐ Financial Services Compliance Pack\
☐ Healthcare & Life Sciences Compliance Pack\
☐ EU AI Act Readiness Pack\
☐ Agentic AI Governance Pack

**Consulting Services:**\
☐ AI Governance Diagnostic\
☐ Compliance-Accuracy Tradeoff Workshop\
☐ Advisory Retainer

**Implementation & Support:**\
☐ Implementation Services\
☐ Support Contract Upgrade\
☐ Training Programs\
☐ Certification Programs

**3.2 Use Case Description**

**Briefly describe your intended use of Phase Mirror:** \*\
(What AI systems will you govern? What problems are you solving?)

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**What types of AI systems will Phase Mirror analyze?** (Select all that
apply)\
☐ Customer-facing AI (chatbots, recommendations, etc.)\
☐ Fraud detection / Anti-money laundering\
☐ Credit decisioning / Underwriting\
☐ Claims processing\
☐ Clinical decision support\
☐ Diagnostic AI (radiology, pathology)\
☐ Internal operations AI\
☐ Document processing / OCR\
☐ Voice/Speech recognition\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**3.3 Criticality Assessment**

**How critical is this service to your operations?** \*

☐ **Critical** - Core business function; significant impact if
unavailable\
☐ **High** - Important business function; moderate impact if
unavailable\
☐ **Medium** - Supporting function; limited impact if unavailable\
☐ **Low** - Non-essential; minimal impact if unavailable

**Would service unavailability impact customers or regulatory
compliance?** \*\
☐ Yes - Direct customer impact\
☐ Yes - Regulatory compliance impact\
☐ Yes - Both customer and regulatory impact\
☐ No - Internal use only, no external impact

**SECTION 4: DATA REQUIREMENTS**

**4.1 Data Types**

**What types of data will be processed through Phase Mirror?** \*
(Select all that apply)

**Personal Data:**\
☐ Employee data (names, emails, job titles)\
☐ Customer names and contact information\
☐ Customer account numbers\
☐ Customer financial information\
☐ Customer transaction history\
☐ Other personal data: \_\_\_\_\_\_\_\_\_\_\_\_

**Sensitive Personal Data:**\
☐ Health information (PHI/medical records)\
☐ Social Security Numbers\
☐ Biometric data\
☐ Genetic information\
☐ Racial/ethnic origin\
☐ Religious beliefs\
☐ Criminal history\
☐ Other sensitive data: \_\_\_\_\_\_\_\_\_\_\_\_

**Business Data:**\
☐ AI system configurations (no personal data)\
☐ Code/source files (no personal data)\
☐ Policy documents\
☐ Governance documentation\
☐ Non-sensitive business data only

☐ **No personal data will be processed** (synthetic/de-identified data
only)

**4.2 Special Data Categories**

**Will Protected Health Information (PHI) be processed?** \*\
☐ Yes - BAA required\
☐ No\
☐ Possibly - Need to assess

**Will Non-Public Personal Information (NPI) under GLBA be processed?**
\*\
☐ Yes\
☐ No\
☐ Possibly - Need to assess

**Will data subject to EU AI Act high-risk classification be involved?**
\*\
☐ Yes - AI systems in Annex III categories\
☐ No\
☐ Unsure - Need classification support

**Will Material Non-Public Information (MNPI) be involved?** \*\
☐ Yes - Enhanced confidentiality required\
☐ No\
☐ Possibly

**4.3 Data Volume**

**Estimated data volume to be processed:** \*\
☐ Small (\< 100 MB/month)\
☐ Medium (100 MB - 1 GB/month)\
☐ Large (1 GB - 10 GB/month)\
☐ Very Large (\> 10 GB/month)\
☐ Unknown at this time

**Estimated number of users:**\
☐ 1-10\
☐ 11-25\
☐ 26-50\
☐ 51-100\
☐ 101-500\
☐ 500+

**SECTION 5: SECURITY REQUIREMENTS**

**5.1 Data Residency**

**Do you have data residency requirements?** \*\
☐ No - Data may be processed globally\
☐ Yes - United States only\
☐ Yes - European Union only\
☐ Yes - Specific country: \_\_\_\_\_\_\_\_\_\_\_\_\
☐ Yes - Custom requirement: \_\_\_\_\_\_\_\_\_\_\_\_

**Is a dedicated instance required?**\
☐ Yes - Isolated infrastructure required\
☐ No - Multi-tenant acceptable\
☐ Prefer dedicated but not required

**5.2 Authentication Requirements**

**What authentication methods do you require?** \* (Select all that
apply)\
☐ Username/password with MFA is acceptable\
☐ SSO required (SAML 2.0)\
☐ SSO required (OIDC)\
☐ Integration with specific IdP: \_\_\_\_\_\_\_\_\_\_\_\_\
☐ Conditional access / device trust required\
☐ Certificate-based authentication required\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_

**5.3 Encryption Requirements**

**Do you have specific encryption requirements?** \*\
☐ Standard encryption (AES-256 at rest, TLS 1.3 in transit) is
acceptable\
☐ Customer-managed encryption keys (CMEK) required\
☐ Bring Your Own Key (BYOK) required\
☐ Hardware Security Module (HSM) required\
☐ FIPS 140-2 validated cryptography required\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_

**5.4 Audit & Logging**

**What audit/logging capabilities do you require?** \* (Select all that
apply)\
☐ Standard audit logging is acceptable\
☐ Real-time access to audit logs required\
☐ SIEM integration required (specify: \_\_\_\_\_\_\_\_\_\_\_\_)\
☐ Custom log retention period required: \_\_\_\_\_\_ years\
☐ Immutable/tamper-evident logs required\
☐ Log export capability required\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_

**5.5 Certifications Required**

**What security certifications do you require from vendors?** \* (Select
all that apply)\
☐ SOC 2 Type II (Phase Mirror: ✅ Current)\
☐ SOC 1 Type II (Phase Mirror: Available upon request)\
☐ ISO 27001 (Phase Mirror: ⏳ Planned)\
☐ ISO 27017 (Cloud Security)\
☐ ISO 27018 (Cloud Privacy)\
☐ FedRAMP (Phase Mirror: Not currently certified)\
☐ HITRUST (Phase Mirror: Not currently certified)\
☐ PCI DSS (Phase Mirror: Not in scope - no payment processing)\
☐ CSA STAR\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_

**SECTION 6: CONTRACTUAL REQUIREMENTS**

**6.1 Contract Structure**

**What contract structure do you prefer?** \*\
☐ Phase Mirror standard Terms of Service\
☐ Phase Mirror standard MSA with negotiated addenda\
☐ Customer paper (your contract template)\
☐ Government contract vehicle (specify: \_\_\_\_\_\_\_\_\_\_\_\_)\
☐ No preference

**Contract term preference:** \*\
☐ Month-to-month\
☐ Annual\
☐ Multi-year (2-3 years)\
☐ No preference

**6.2 Required Agreements**

**Which agreements will you require?** \* (Select all that apply)\
☐ Master Services Agreement (MSA)\
☐ Data Processing Agreement (DPA) - GDPR\
☐ Business Associate Agreement (BAA) - HIPAA\
☐ Standard Contractual Clauses (SCCs) - International transfer\
☐ Non-Disclosure Agreement (NDA)\
☐ Service Level Agreement (SLA) - detailed\
☐ Information Security Agreement / Addendum\
☐ Insurance Certificate\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_

**6.3 Liability & Indemnification**

**Do you have specific liability requirements?** \*\
☐ Standard liability cap (12 months fees) is acceptable\
☐ Higher liability cap required: \$\_\_\_\_\_\_\_\_\_\_\_\_\
☐ Unlimited liability for data breaches required\
☐ Specific indemnification language required\
☐ Will negotiate based on risk assessment

**Do you require specific insurance minimums?** \*\
☐ Standard coverage is acceptable\
☐ Cyber liability minimum: \$\_\_\_\_\_\_\_\_\_\_\_\_M\
☐ E&O minimum: \$\_\_\_\_\_\_\_\_\_\_\_\_M\
☐ General liability minimum: \$\_\_\_\_\_\_\_\_\_\_\_\_M\
☐ Will negotiate based on risk assessment

**6.4 Audit Rights**

**What audit rights do you require?** \*\
☐ Annual SOC 2 report review is sufficient\
☐ Annual on-site audit right required\
☐ On-site audit with less than 30 days notice required\
☐ Regulator audit cooperation required\
☐ Unlimited audit rights required\
☐ Will negotiate based on criticality

**SECTION 7: INTEGRATION REQUIREMENTS**

**7.1 Technical Integration**

**Will Phase Mirror integrate with other systems?** \* (Select all that
apply)\
☐ No integrations required - standalone use\
☐ Source code repositories (GitHub, GitLab, Bitbucket)\
☐ CI/CD pipelines (Jenkins, GitHub Actions, Azure DevOps)\
☐ SIEM platform (Splunk, Sumo Logic, etc.)\
☐ GRC platform (ServiceNow, Archer, etc.)\
☐ Ticketing system (Jira, ServiceNow)\
☐ Identity provider (Okta, Azure AD, Ping)\
☐ Data warehouse / analytics\
☐ Custom integration via API\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_

**7.2 API Requirements**

**Do you have specific API requirements?**\
☐ REST API access required\
☐ Webhook support required\
☐ Bulk data export API required\
☐ Rate limiting requirements: \_\_\_\_\_\_ requests/minute\
☐ API versioning/deprecation policy required\
☐ OpenAPI/Swagger documentation required\
☐ No specific API requirements

**SECTION 8: SUPPORT & SERVICE LEVELS**

**8.1 Support Requirements**

**What support level do you require?** \*\
☐ Standard (Email, 24-hour critical response)\
☐ Priority (Email + Phone, 4-hour critical response)\
☐ Premium/TAM (Dedicated TAM, 1-hour critical response)\
☐ Will evaluate based on pricing

**Do you require 24/7 support?** \*\
☐ Yes - 24/7/365 support required\
☐ No - Business hours support acceptable\
☐ 24/7 for critical issues only

**8.2 SLA Requirements**

**What uptime SLA do you require?** \*\
☐ 99.0% (Standard - \~7.3 hours downtime/month)\
☐ 99.5% (Enhanced - \~3.6 hours downtime/month)\
☐ 99.9% (Premium - \~43 minutes downtime/month)\
☐ 99.99% or higher (Not currently available)\
☐ No specific requirement

**Do you require service credits for SLA breaches?** \*\
☐ Yes - Standard credits acceptable\
☐ Yes - Enhanced credits required\
☐ No - SLA commitment sufficient

**8.3 Implementation Support**

**What implementation support do you need?** \*\
☐ Self-service implementation (documentation only)\
☐ Guided implementation (remote support)\
☐ Full implementation services (Phase Mirror-led)\
☐ Custom implementation with dedicated project manager\
☐ To be determined based on scoping

**Desired go-live timeline:**\
☐ \< 30 days\
☐ 30-60 days\
☐ 60-90 days\
☐ 90+ days\
☐ Flexible / No specific timeline

**SECTION 9: BUSINESS CONTINUITY**

**9.1 Recovery Requirements**

**What are your Recovery Time Objective (RTO) requirements?** \*\
☐ \< 4 hours (Enterprise tier required)\
☐ 4-8 hours (Business tier or higher)\
☐ 8-24 hours (Team tier or higher)\
☐ \> 24 hours (Standard acceptable)\
☐ No specific RTO requirement

**What are your Recovery Point Objective (RPO) requirements?** \*\
☐ \< 1 hour (Enterprise tier required)\
☐ 1-4 hours (Business tier or higher)\
☐ 4-24 hours (Team tier or higher)\
☐ \> 24 hours (Standard acceptable)\
☐ No specific RPO requirement

**9.2 Exit Strategy**

**What exit provisions are important to you?** \* (Select all that
apply)\
☐ Data export in standard formats\
☐ Transition assistance period\
☐ Source code escrow\
☐ Termination for convenience (without penalty)\
☐ Data destruction certification\
☐ Extended data retention post-termination\
☐ API access during transition period

**SECTION 10: TIMELINE & PROCESS**

**10.1 Procurement Timeline**

**What is your target decision date?** \*\
☐ \< 30 days\
☐ 30-60 days\
☐ 60-90 days\
☐ 90-180 days\
☐ \> 180 days\
☐ Just researching / No specific timeline

**Is this a new procurement or renewal/expansion?** \*\
☐ New vendor evaluation\
☐ Renewal of existing Phase Mirror contract\
☐ Expansion of existing Phase Mirror services\
☐ Replacement of existing vendor: \_\_\_\_\_\_\_\_\_\_\_\_

**10.2 Evaluation Process**

**Who is involved in the evaluation?** \* (Select all that apply)\
☐ Procurement / Vendor Management\
☐ Information Security / CISO\
☐ Compliance / Risk\
☐ Legal\
☐ IT / Engineering\
☐ Business Stakeholders\
☐ Executive Sponsor\
☐ Board / Committee Approval Required

**What is your evaluation process?** \*\
☐ Standard procurement (questionnaire review, pricing)\
☐ Security assessment required\
☐ Proof of concept / trial required\
☐ Reference checks required\
☐ On-site visit / audit required\
☐ Multiple rounds of review (committee, board, etc.)\
☐ RFP response required

**10.3 Budget**

**Do you have an approved budget?** \*\
☐ Yes - Budget approved\
☐ Yes - Budget range identified\
☐ No - Seeking pricing for budget approval\
☐ Prefer not to disclose

**Budget range (if willing to share):**\
☐ \< \$25,000/year\
☐ \$25,000 - \$50,000/year\
☐ \$50,000 - \$100,000/year\
☐ \$100,000 - \$250,000/year\
☐ \> \$250,000/year\
☐ Prefer not to disclose

**SECTION 11: ADDITIONAL INFORMATION**

**11.1 Specific Questions or Concerns**

**Do you have specific questions or concerns you\'d like addressed?**

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**11.2 Previous Vendor Issues**

**Have you experienced issues with similar vendors in the past?**\
☐ No\
☐ Yes (please describe, so we can proactively address):

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**11.3 References**

**Would you like references from similar organizations?** \*\
☐ Yes - Same industry\
☐ Yes - Similar size\
☐ Yes - Similar use case\
☐ No - Not at this time

**SECTION 12: DOCUMENT REQUESTS**

**12.1 Documents Needed**

**Which documents would you like us to provide?** \* (Select all that
apply)

**Security & Compliance:**\
☐ SOC 2 Type II Report (requires NDA)\
☐ SOC 1 Type II Report (requires NDA)\
☐ Penetration Test Executive Summary (requires NDA)\
☐ Security Policy Overview (requires NDA)\
☐ Business Continuity Plan Summary (requires NDA)\
☐ Incident Response Plan Summary (requires NDA)

**Contractual:**\
☐ Data Processing Agreement (DPA) template\
☐ Business Associate Agreement (BAA) template\
☐ Master Services Agreement (MSA) template\
☐ Standard Terms of Service\
☐ Service Level Agreement (SLA) details

**Insurance & Financial:**\
☐ Certificate of Insurance (Cyber)\
☐ Certificate of Insurance (E&O)\
☐ Certificate of Insurance (General Liability)\
☐ D&B Credit Report

**Compliance:**\
☐ GDPR Compliance Summary\
☐ GLBA Safeguards Mapping\
☐ HIPAA Compliance Summary\
☐ Sub-processor List\
☐ Privacy Policy

**Questionnaire Responses:**\
☐ Completed SIG Questionnaire\
☐ Completed CAIQ Questionnaire\
☐ Custom Questionnaire (attach): \_\_\_\_\_\_\_\_\_\_\_\_

**12.2 Custom Questionnaire**

**Do you have a custom security/vendor questionnaire you\'d like us to
complete?** \*\
☐ No - Standard questionnaires (SIG/CAIQ) are sufficient\
☐ Yes - I will upload my questionnaire\
☐ Yes - I will email my questionnaire to
[[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)

**If yes, how many questions?**\
☐ \< 50 questions\
☐ 50-100 questions\
☐ 100-250 questions\
☐ 250-500 questions\
☐ \> 500 questions

**Questionnaire turnaround needed:**\
☐ \< 1 week\
☐ 1-2 weeks\
☐ 2-4 weeks\
☐ \> 4 weeks

**SECTION 13: NDA & CONSENT**

**13.1 Non-Disclosure Agreement**

**To receive certain documents (SOC 2, security policies, etc.), an NDA
is required.**

☐ We have an existing NDA with Phase Mirror (Date:
\_\_\_\_\_\_\_\_\_\_\_\_)\
☐ We will use Phase Mirror\'s standard NDA\
☐ We require use of our NDA template\
☐ We do not need NDA-protected documents at this time

**13.2 Consent & Submission**

**By submitting this form, I acknowledge that:**

☐ The information provided is accurate to the best of my knowledge \*\
☐ I am authorized to request vendor due diligence on behalf of my
organization \*\
☐ I consent to Phase Mirror processing this information to prepare due
diligence materials \*\
☐ I understand that certain documents require NDA execution before
delivery \*

**Electronic Signature:** \*\
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Date:** \*\
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**WHAT HAPPENS NEXT**

**After you submit this form:**

  Step   Timeline             Action
  ------ -------------------- -------------------------------------------------------
  1      Immediate            Automated confirmation email with tracking number
  2      1 business day       Initial document package delivered (public documents)
  3      1-2 business days    NDA sent for signature (if required)
  4      Upon NDA execution   Confidential documents delivered (SOC 2, etc.)
  5      3-5 business days    Custom questionnaire response (if submitted)
  6      5 business days      Customized risk assessment and recommendations
  7      As scheduled         Follow-up call with security/compliance team

**Expedited Processing:**\
For urgent requests, contact
[[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)
with subject line \"URGENT: Due Diligence Request\"

**INTERNAL USE ONLY (Phase Mirror)**

**Auto-Generated Assessment**

**Based on responses, auto-populate:**

**Risk Tier:** ☐ Critical ☐ High ☐ Medium ☐ Low

**Recommended Product Tier:** ☐ Team ☐ Business ☐ Enterprise

**Required Agreements:**\
☐ Standard ToS\
☐ MSA\
☐ DPA\
☐ BAA\
☐ SCCs\
☐ Custom

**Required Documents:**\
☐ SOC 2\
☐ SOC 1\
☐ Pen Test\
☐ Insurance Certs\
☐ SIG\
☐ CAIQ\
☐ Custom Questionnaire

**Assigned To:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**SLA for Response:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Special Handling Notes:**

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**FORM SUBMISSION**

**Submit this form via:**

-   **Online:**
    > [[https://phasemirror.com/due-diligence]{.underline}](https://phasemirror.com/due-diligence)

-   **Email:**
    > [[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)

-   **Portal:** \[Customer portal link\]

**Questions about this form:**

-   Email:
    > [[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)

-   Phone: \[Phone number\]

**AUTOMATION LOGIC REFERENCE**

**Document Package Auto-Selection**

**If Industry = Financial Services:**\
→ Include: Financial Services TPRM Package, GLBA Mapping, SR 11-7
Alignment

**If Industry = Healthcare:**\
→ Include: BAA Template, HIPAA Compliance Summary, Healthcare Pack Info

**If GDPR Compliance = Yes:**\
→ Include: DPA Template, SCCs, TIA Summary

**If Data Residency = EU Only:**\
→ Flag: Enterprise tier required, EU instance discussion

**If PHI = Yes:**\
→ Include: BAA Template, Require BAA execution before onboarding

**If Criticality = Critical:**\
→ Flag: Enterprise tier recommended, Executive engagement

**If Certification = FedRAMP Required:**\
→ Flag: Not currently certified, discuss timeline/alternatives

**If Custom Questionnaire \> 250 questions:**\
→ Flag: Extended timeline, potential additional fee

**If Timeline \< 30 days AND Custom Questionnaire:**\
→ Flag: Expedited processing required, escalate to manager

This intake form automates the collection of requirements and generates
appropriate documentation packages. Would you like me to create:

-   A web form version (HTML/CSS) for online submission

-   Integration specifications for your CRM (Salesforce, HubSpot)

-   Automated email response templates for each scenario

-   A scoring algorithm for risk tier auto-calculation

-   A Slack/Teams notification workflow for new submissions?

⁂

1.  A Clear Guide to Phase Mirror\'s Services.pdf

2.  Phase mirror dissonance\_\_\_Open core must be useful.pdf

3.  Phase Mirror\_ Comprehensive Services Catalog.docx.pdf

4.  License\_ Strategic & Legal Analysis.pdf

5.  Phase Mirror\_ Consultation & SaaS.pdf

6.  Agentic Domain-Specific Reasoning.pdf

7.  Policy Memo\_ Managing Agentic AI Liability with the Phase Mirror
    > Framework.pdf

8.  The Phase Mirror does not resolve dissonance---it names it.pdf

9.  Understanding Phase Mirror Dissonance\_ A Beginner\'s Guide.pdf

10. The Phase of Mirror Dissonance.pdf

11. Implementation Guide\_ Applying Phase Mirror Dissonance.pdf
