TPR-03 · Third Parties and Supply Chain
Contractual terms and offboarding
Contracts carry security, privacy and breach terms, and access and data are recovered when the relationship ends.
6frameworks fully address it
2partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC9.2
- ISO 27001FullA.5.20
- NIST CSFFullGV.SC-05
- PCI DSSFull12.8.2
- HIPAAFull164.314(a)
- GDPRFullArt. 28(3)
- EU AI ActPartialArt. 25(4) Written agreements along the value chain.
- NIST AI RMFPartialGOVERN 6.2 Contingency for third-party failure.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Executed terms, offboarding checklist, deletion confirmations.
?Why it exists
The end of a relationship is where data is most often left behind.
For a smaller organizationA short addendum and a close-out checklist.