Additional ISO/IEC 27002 guidance for PII processors, ISO 27701:2019
ISO 27701:2019 8.5.7: Engagement of a subcontractor to process PII
The organization may use a subcontractor for personal data processing only as the customer contract allows, obtaining written authorization from the customer before the subcontractor processes the data, either through suitable terms in the customer contract or through a one off agreement for the purpose, holding a written contract with every such subcontractor that addresses implementation of the appropriate processor controls, requiring the subcontractor to implement them in light of the risk assessment and the scope of processing, with all such controls assumed relevant by default and any exclusion justified, responsibilities being allocable differently provided every control is considered and documented.
This control maps to 38 controls across 14 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
You are reading one control. How much of ISO 27701:2019 have you already done?
ISO 27701:2019 8.5.7 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.