P6.4 Obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and as-needed
Obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Signed privacy commitments for each, such as contract clauses, data processing terms or a data protection agreement · Vendor register / contract repository
- Records of the periodic assessment of those parties' compliance, with the assessment method used · Data governance / DLP tooling
- Records of as-needed assessments triggered by an event, such as a change in processing or an incident · Data governance / DLP tooling
- Findings from assessments and evidence of remediation or escalation · Data governance / DLP tooling
governing documentDocuments that govern the control
- Inventory of vendors and other third parties with access to personal information · Vendor register / contract repository
First move
Common gaps auditors find
- Commitments obtained from contracted vendors while sub-processors they engage carry no equivalent commitment
- Assessment consists of collecting a report at onboarding, with no periodic re-assessment as the criterion requires
- Assessment findings recorded with no follow-up, so a non-compliant processor keeps access
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP6.3 Creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity's objectives related to privacy. The following point of focus, which · P6.5 Obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to