TPR-02 · Third Parties and Supply Chain
Due diligence proportionate to risk
Third parties are assessed before onboarding and periodically thereafter, at a depth proportionate to what they touch.
6frameworks fully address it
2partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC9.2
- ISO 27001FullA.5.21
- NIST CSFFullGV.SC-07
- PCI DSSFull12.8.4
- HIPAAPartial164.308(b) Satisfactory assurances through the agreement.
- GDPRFullArt. 28(1)
- EU AI ActPartialArt. 25 Contractual duties between value chain actors.
- NIST AI RMFFullGOVERN 6.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Assessment records, tiering rationale, reassessment dates.
?Why it exists
A questionnaire sent to everyone is a questionnaire nobody reads.
For a smaller organizationTwo tiers, a short set of questions for the lower one.