8.5.7 Engagement of a subcontractor to process PII
The organization must engage a subcontractor to process personal data only according to the customer contract, obtaining written authorization from the customer before the subcontractor processes the data, whether throug
5
artefacts
0
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the risk assessment and processing scope informed which controls were required · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Written customer authorization for each subcontractor, whether general or specific · Document repository
- Written contract with every subcontractor carrying the processor control obligations · Vendor register / contract repository
- Justification for any processor control not required of a subcontractor · Document repository
- Reconciliation between subcontractors actually used and those authorized · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Subcontractor engaged on the strength of a general authorization that does not in fact cover it
- Subcontractor contracts carrying security terms while the processor control set is never flowed down
- Controls omitted by silence rather than justified exclusion
- Tooling and infrastructure providers that process personal data not recognised as subcontractors
- Authorization obtained once and not revisited when the subcontractor's scope of processing grew
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.5.6 Disclosure of subcontractors used to process PII · 8.5.8 Change of subcontractor to process PII