8.2.5 Customer obligations
The organization must give the customer the information the customer needs to demonstrate compliance with its own obligations, which can include whether the organization allows for and contributes to audits conducted by
4
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Documented information package provided to customers for their own compliance evidence · Document repository
- Records of audits allowed or contributions made · Document repository
- Evidence the package is kept current · Document repository
governing documentDocuments that govern the control
- Contract terms on audit rights and how they are exercised · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Assurance offered as a certificate whose scope does not cover the service the customer bought
- Audit rights granted contractually and refused in practice through commercial friction
- Information package written once and stale on control changes
- Customer left to assemble compliance evidence from marketing material
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.2.4 Infringing instruction · 8.2.6 Records related to processing PII