P6.4 Privacy commitments from vendors and third parties

Privacy commitments are obtained from vendors and others outside the organisation that can reach personal information, their compliance is assessed periodically and as needed, and corrective action is taken where necessary. Points of focus: information goes only to third parties with agreements to protect it consistently with the notice, whose controls are evaluated; and misuse by a third party that received information triggers remedial action. As revised in 2022, the organisation also has procedures to evaluate whether third parties meet their privacy commitments.

Source: SOC 2 (2017 Trust Services Criteria), P6.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.