SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties
SOC2-P6.4 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
P6.4 Privacy commitments from vendors and third parties. Privacy commitments are obtained from vendors and others outside the organisation that can reach personal information, their compliance is assessed periodically and as needed, and corrective action is taken where necessary. Points of focus: information goes only to third parties with agreements to protect it consistently with the notice, whose controls are evaluated; and misuse by a third party that received information triggers remedial action. As revised in 2022, the organisation also has procedures to evaluate whether third parties meet their privacy commitments.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) (closest match)
- 164.308(b)(2) Subcontractor Arrangements (closest match)
- 164.308(b)(3) Written Contract or Other Arrangement (closest match)
- 164.314(a)(1) Business Associate Contracts or Other Arrangements (Standard) (closest match)
- 164.314(a)(2)(i) Business Associate Contract Required Provisions (closest match)
- 164.314(a)(2)(iii) Business Associate Contracts with Subcontractors (closest match)
- 164.314(b)(1) Requirements for Group Health Plans (Standard) (closest match)
- 164.314(b)(2) Implementation Specifications for Group Health Plans (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-20 AC-20 Use of External Systems (closest match)
- NIST800-AC-21 AC-21 Information Sharing (closest match)
- NIST800-AU-16 AU-16 Cross-organizational Audit Logging (closest match)
- NIST800-CA-3 CA-3 Information Exchange (closest match)
- NIST800-CA-7 CA-7 Continuous Monitoring (closest match)
- NIST800-PM-9 PM-9 Risk Management Strategy (closest match)
- NIST800-PM-18 PM-18 Privacy Program Plan (closest match)
- NIST800-PM-27 PM-27 Privacy Reporting (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: P - Privacy), in our words, not a statement of the standard and not binding on an assessor.
- the privacy notice and its change log
- the consent and preference records
- the data-subject request log with resolution
- the retention and disposal records