Compliance Risk &

Information Security Partners

Introducing the new small business third-party risk management company

01-A: Subcontractor Control

This section assesses how your organization selects, contracts, and oversees subcontractors and other third parties involved in delivering your services. The questions verify that you perform risk-based due diligence, require appropriate security, privacy, and compliance obligations in your contracts, and limit subcontractor access to only what is necessary. They also confirm that you monitor subcontractor performance and address issues or changes in a controlled way, so protections remain consistent with your own internal standards.

Full Name *

Email *

Organization *

Phone *

Address

Street Address

City

State

Country

Postal code

Website

By checking this box, I consent to receive transactional messages related to my account, orders, or services I have requested. These messages may include appointment reminders, order confirmations, and account notifications among others. Message frequency may vary. Message & Data rates may apply. Reply HELP for help or STOP to opt-out.

By checking this box, I consent to receive marketing and promotional messages, including special offers, discounts, new product updates among others. Message frequency may vary. Message & Data rates may apply. Reply HELP for help or STOP to opt-out.

Privacy Policy | Terms of Service

01-7. Does your company use subcontractors to perform any of the work our client assigns to you?

Yes

No

N/A

Explanation: Understanding the flow of customer data is critical to managing data protection risks. If subcontractors access sensitive data, additional controls must be in place to ensure security.

Risks of Incorrect Answer: Potential exposure of sensitive client data to unsecure third-party environments. Increased likelihood of data breaches or non-compliance with data protection laws.

Applicable Frameworks: HIPAA (164.308(b)(1)): Requires managing subcontractors accessing protected health information. GDPR (Art. 28): Mandates oversight of processors handling personal data."

01-7. If yes, do you get approval from our client before outsourcing? *

01-7. If No or N/A, please provide an additional explanation

1.1-8: Do your subcontractors or third-party vendors have access to our client’s customer data? *

Yes

No

N/A

Explanation: Understanding the flow of customer data is critical to managing data protection risks. If subcontractors access sensitive data, additional controls must be in place to ensure security.

Risks of Incorrect Answer:

Potential exposure of sensitive client data to unsecure third-party environments.

Increased likelihood of data breaches or non-compliance with data protection laws.

Applicable Frameworks: HIPAA (164.308(b)(1)): Requires managing subcontractors accessing protected health information.

GDPR (Art. 28): Mandates oversight of processors handling personal data.

1.1-8 If yes, please describe the type of data they access.

1.1-8. If No or N/A, please provide an additional explanation

2.9. Do you have written policies and procedures in place to manage third-party access to physical and digital resources related to our client’s work? *

Yes

No

N/A

Explanation: Having documented policies ensures consistency and accountability when managing third-party access to sensitive client resources.

Risks of Incorrect Answer: Lack of standardized procedures could lead to inconsistent or insecure handling of sensitive resources.

Difficulty proving due diligence in case of regulatory audits.

Applicable Frameworks:

NIST CSF (PR.AC-3): Access permissions and authorizations are managed with policies.

ISO 27001 (A.9.2.1): Formal processes for granting and revoking access.

2.9- If possible, please provide these policies.

2.9. If No or N/A, please provide an additional explanation

3.8. Does your company have a formal process to approve third-party vendors working on tasks assigned by our client? *

Yes

No

N/A

Explanation: A formal approval process ensures that third-party vendors are vetted and aligned with the client’s security and operational requirements.

Risks of Incorrect Answer: Engaging with unverified or non-compliant vendors.

Increased likelihood of reputational damage or non-compliance fines if a vendor fails to meet standards.

Applicable Frameworks: ISO 27001 (A.15.1.2): Requires addressing security in third-party agreements.

SOC 2: Vendor management is essential for operational security.

3.8. If No or N/A, please provide an additional explanation

4.9. Do you require your third-party vendors to follow specific security and operational standards when handling tasks related to our client? *

Yes

No

N/A

Explanation: Ensuring third parties follow recognized frameworks mitigates security and compliance risks.

Risks of Incorrect Answer: Lack of adherence to standards could lead to inadequate security measures.

Non-compliance with regulations may result in fines or legal action.

Applicable Frameworks: NIST CSF (PR.IP-12): Formalizes third-party security requirements.

GDPR (Art. 28): Requires written agreements with data processors specifying compliance.

4.9 If yes, please specify the standards (e.g., NIST, HIPAA, GDPR, etc.).

4.9. If No or N/A, please provide an additional explanation

5.6.Does your company require confidentiality or nondisclosure agreements for all third parties working on assignments from our client? *

Yes

No

N/A

Explanation: NDAs protect sensitive information by legally binding third parties to confidentiality.

Risks of Incorrect Answer: Unintentional or malicious data leaks due to lack of legal accountability.

Difficulty enforcing data protection in the event of a breach.

Applicable Frameworks: ISO 27001 (A.13.2.4): Ensures confidentiality agreements are part of the security framework.

SOC 2: Emphasizes protecting sensitive information from unauthorized access.

5.6. If No or N/A, please provide an additional explanation

Thank you for taking the time to complete the 01-A: Vendor Assessment - Subcontractor Control section of the Vendor Assessment.

Please click Submit to record your responses and proceed to the next survey: 02-B: Organizational Security.

Compliance Risk &

Information Security
Partners

CRISP

Empowering small businesses
with BIG Solutions

HOME

ABOUT

CONTACT

Some or all of the services described in this engagement may not be available to certain clients, including those who have affiliations or relationships with audit firms or related entities.

The information provided herein is of a general nature and is not intended to address the specific circumstances of any individual or entity. While we strive to offer accurate and up-to-date information, we cannot guarantee its accuracy at the time it is received or in the future. No action should be taken based solely on this information without seeking appropriate professional advice tailored to your particular situation. CRISP does not provide legal or tax advice.

This information is not intended to constitute “written advice concerning one or more Federal tax matters” as defined by section 10.37(a)(2) of Treasury Department Circular 230.

Contact Us

Let’s discuss your unique security needs and address any other questions you may have. Contact us today for a free consultation and take the next step towards strengthening your company’s defenses.

LEGAL POLICIES

Privacy Policy

Terms & Conditions

Disclaimer

Cookie Policy

DSAR

Refunds/Returns

Shipping Policy

EULA

Message

I Consent to Receive SMS Notifications, Alerts & Occasional Marketing Communication from CRISP. Message frequency varies. Message & data rates may apply. Text HELP to (330) 737-2223 for assistance. You can reply STOP to unsubscribe at any time.

​Compliance Risk &

Information Security Partners

Introducing the new small business third-party risk management company

01-A: Subcontractor Control

​Compliance Risk &

Information SecurityPartners

Empowering small businesses with BIG Solutions

HOME

ABOUT

Contact Us

LEGAL POLICIES

Compliance Risk &

Compliance Risk &

Information Security
Partners

Empowering small businesses
with BIG Solutions