8.5.6 Disclosure of subcontractors used to process PII
The organization must disclose to the customer any use of subcontractors to process personal data before that use, with provisions included in the customer contract, disclosing that subcontracting is used and the names o
5
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of disclosure before use, not after · Document repository
- Where disclosure is restricted, the risk assessment behind it and evidence the customer knows the information is available · Policy repository / GRC workspace
- Evidence the country list is disclosed in all cases · Document repository
governing documentDocuments that govern the control
- Current subcontractor list with names, the countries they can transfer to, and how their obligations are secured · Document repository
- Contract provisions covering subcontractor disclosure · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Subcontractors disclosed only on request, with customers never told the information exists
- New subcontractors used first and disclosed at the next contract review
- List naming subcontractors without their transfer destinations, so the customer cannot inform individuals
- Security risk cited to withhold the country list, which the standard says must always be disclosed
- Fourth party subcontractors, engaged by the organization's own subcontractors, omitted entirely
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.5.5 Legally binding PII disclosures · 8.5.7 Engagement of a subcontractor to process PII