SOC 2 · P - Privacy
SOC 2 P6.5: P6.5 Vendor commitments to report unauthorised disclosures
SOC 2 P6.5 covers P6.5 Vendor commitments to report unauthorised disclosures. The held text names 2 evidence records for it, the first being Contract clauses requiring vendor breach notification within a defined time. The common gap an assessor flags is Contracts lack a notification time frame.
Outside parties, vendors included, that can reach personal information commit to notify the organisation of actual or suspected unauthorised disclosures; notifications reach the right people and are handled under incident response procedures. Points of focus: remedial action follows misuse by a third party; and a process obtains commitments from vendors to report actual or suspected unauthorised disclosures.
What evidence supports P6.5?
- Vendor breach notificationContract clauses requiring vendor breach notification within a defined time
- Vendor breach notificationVendor-reported incidents logged in the incident process
Where this requirement comes from
This is our own statement of SOC 2 P6.5, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Contracts lack a notification time frame
- Vendor notifications received by email with no incident record
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.