Subcontractors and subprocessors: the clause the question tests
Who else touches the customer's data on the supplier's behalf, including the providers that host it, and whether the customer is told before that changes.
How the customer usually asks it
example"Do you use subcontractors to process our data? List them."
Anchor clauses
6 frameworks| Framework | Anchor clause |
|---|---|
| ISO/IEC 27001:2022 | 5.19 Information security in supplier relationships · 5.20 Addressing information security within supplier agreements · 5.21 Managing information security in the ICT supply chain |
| SOC 2 (Trust Services Criteria) | CC9.2 Risk mitigation activities include assessment of vendor and business partner controls |
| SIG (Shared Assessments) | domain T Supply Chain Risk Management |
| CSA Cloud Controls Matrix v4.0.1 | DSP-13 Personal Data Sub-processing |
| PCI DSS v4.0.1 | 12.8.1 Third-party service provider inventory |
| GDPR, Regulation (EU) 2016/679 | Art. 28 Processor |
Every framework that anchors this family is listed here; a register shows the ones ticked for the customer.
Evidence expected
The list of subprocessors with what each does, where it processes and what data it reaches, the contract terms that flow down, and the notice route for changes.
The clauses, with what an assessor asks for
ISO 27001 5.19 Information security in supplier relationshipsDefine and apply processes to manage the security risk suppliers introduce.
Where answers usually fall short: Treating all suppliers as low risk; Missing security clauses in contracts
Source: ISO/IEC 27001:2022
ISO 27001 5.20 Addressing information security within supplier agreementsEstablish and agree the relevant security requirements in each supplier contract.
Where answers usually fall short: Missing explicit security clauses; No documented risk assessment before onboarding
Source: ISO/IEC 27001:2022
ISO 27001 5.21 Managing information security in the ICT supply chainExtend security requirements down the ICT products and services supply chain.
Where answers usually fall short: Treating supplier security as one-off check; Missing contractual security clauses
Source: ISO/IEC 27001:2022
SOC 2 CC9.2 Risk mitigation activities include assessment of vendor and business partner controlsNamed, not quoted: the criteria text is not held in full here.
Where answers usually fall short: Assurance reports collected and filed with no review of the exceptions or of the complementary user entity controls they assume the entity performs; Inventory covering vendors known to procurement, missing services engaged directly by teams
Source: SOC 2 (Trust Services Criteria)
SIG domain T Supply Chain Risk ManagementWhat it asks for, in one line (the standard's own text is not quoted here):
Manage risk across the supply chain including subservice organizations, fourth parties, hardware and software providers, and concentration risk, with appropriate due diligence and continuous monitoring.
Where answers usually fall short: No fourth party visibility; Continuous monitoring not actioned
Source: SIG (Shared Assessments)
CSA CCM DSP-13 Personal Data Sub-processingWhat it asks for, in one line (the standard's own text is not quoted here):
Control how personal data is passed to and processed by sub-processors in the service supply chain, in line with applicable law.
Where answers usually fall short: Sub-processors engaged by delivery teams without the register being updated; Contracts silent on data protection obligations
Source: CSA Cloud Controls Matrix v4.0.1
PCI DSS 12.8.1 Third-party service provider inventoryWhat it asks for, in one line (the standard's own text is not quoted here):
A list of all third-party service providers (TPSPs) with which account data is shared, or that could affect the security of account data, is maintained, including a description of services provided.
Where answers usually fall short: TPSP register incomplete; No internal owner
Source: PCI DSS v4.0.1
GDPR Art. 28 ProcessorUse only processors providing sufficient guarantees to implement appropriate technical and organisational measures such that the processing meets the Regulation's requirements and protects the rights of the data subject. A processor must not engage another processor without the controller's prior specific or general written authorisation, and under a general authorisation must inform the controller of intended additions or replacements so the controller can object. The processing must be governed by a written contract or other legal act binding the processor to the controller, setting out the subject matter and duration, the nature and purpose, the type of personal data, the categories of data subjects and the controller's obligations and rights, and stipulating that the processor processes only on documented controller instructions including as to transfers, ensures persons authorised to process are under a duty of confidentiality, takes all Article 32 measures, respects the sub-processor conditions, assists the controller in responding to data subject rights requests, assists with Articles 32 to 36, deletes or returns all personal data at the controller's choice at the end of the service and deletes existing copies unless law requires retention, and makes available all information needed to demonstrate compliance and allows for and contributes to audits and inspections. The processor must immediately inform the controller if it considers an instruction infringes data protection law. The same obligations must be imposed on any sub-processor, and the initial processor remains fully liable for the sub-processor's performance. A processor that determines purposes and means is a controller for that processing.
Where answers usually fall short: The processor's own standard terms accepted, which commonly omit the audit right, the deletion choice and the instruction infringement notice; A processor inventory that misses tools adopted directly by individual teams, which is where undocumented processing usually sits
Source: GDPR, Regulation (EU) 2016/679