SOC 2 SOC2-P6.5: P6.5 Vendor commitments to report unauthorised disclosures
Outside parties, vendors included, that can reach personal information commit to notify the organisation of actual or suspected unauthorised disclosures; notifications reach the right people and are handled under incident response procedures. Points of focus: remedial action follows misuse by a third party; and a process obtains commitments from vendors to report actual or suspected unauthorised disclosures.
This control maps to 88 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.CM-06 External service provider activities and services are monitored to find potentially adverse events
NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
NIST-CSF-GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
NIST-CSF-GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
NIST-CSF-RS.CO-02 Internal and external stakeholders are notified of incidents
NIST-CSF-RS.CO-03 Information is shared with designated internal and external stakeholders
NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
You are reading one control. How much of SOC 2 have you already done?
SOC 2 SOC2-P6.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.