Additional ISO/IEC 27002 guidance for PII controllers, ISO 27701:2019
ISO 27701:2019 7.2.6: Contracts with PII processors
The organization must have a written contract with every processor it uses and must ensure those contracts address implementation of the appropriate processor controls, requiring the processor to implement them in light of the risk assessment and the scope of processing it performs, with all such controls assumed relevant by default and any decision not to require one justified in the Statement of Applicability, responsibilities being allocable differently between the parties provided every control is considered and documented.
This control maps to 44 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
You are reading one control. How much of ISO 27701:2019 have you already done?
ISO 27701:2019 7.2.6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.