SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures
SOC2-P6.5 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
P6.5 Vendor commitments to report unauthorised disclosures. Outside parties, vendors included, that can reach personal information commit to notify the organisation of actual or suspected unauthorised disclosures; notifications reach the right people and are handled under incident response procedures. Points of focus: remedial action follows misuse by a third party; and a process obtains commitments from vendors to report actual or suspected unauthorised disclosures.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) (closest match)
- 164.308(b)(2) Subcontractor Arrangements (closest match)
- 164.308(b)(3) Written Contract or Other Arrangement (closest match)
- 164.314(a)(1) Business Associate Contracts or Other Arrangements (Standard) (closest match)
- 164.314(a)(2)(i) Business Associate Contract Required Provisions (closest match)
- 164.314(a)(2)(iii) Business Associate Contracts with Subcontractors (closest match)
- 164.314(b)(1) Requirements for Group Health Plans (Standard) (closest match)
- 164.314(b)(2) Implementation Specifications for Group Health Plans (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-20 AC-20 Use of External Systems (closest match)
- NIST800-AU-13 AU-13 Monitoring for Information Disclosure (closest match)
- NIST800-AU-16 AU-16 Cross-organizational Audit Logging (closest match)
- NIST800-CA-3 CA-3 Information Exchange (closest match)
- NIST800-IR-6 IR-6 Incident Reporting (closest match)
- NIST800-PS-7 PS-7 External Personnel Security (closest match)
- NIST800-SA-9 SA-9 External System Services (closest match)
- NIST800-SR-1 SR-1 Policy and Procedures (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: P - Privacy), in our words, not a statement of the standard and not binding on an assessor.
- the privacy notice and its change log
- the consent and preference records
- the data-subject request log with resolution
- the retention and disposal records