Transmission of digital output beyond the of the system occurs through the use software supporting the advanced standard. C1.4 The entity obtains confidentiality commitments Related party and vendor personnel are unaware Formal information sharing agreements are in that are consistent with the of the entity's confidentiality commitments. place with related parties and vendors. These entity’s requirements, from vendors and other third agreements include confidentiality commitments parties whose products and services comprise applicable to that entity. Agreement terms include part of the system and have access to requirements for marking and identifying data as information. confidential, handling standards for confidential data in the custody of related parties and and return and disposal of confidential when no longer required. Requirements for handling of confidential Formal information sharing agreements are in are not communicated to and agreed to place with related parties and vendors. These by related parties and vendors. agreements include confidentiality commitments applicable to that entity. C1.5 Compliance with confidentiality commitments Related party and vendor systems are not Related party and vendor systems are subject to and requirements by vendors and others third designed or operating effectively to comply review as part of the vendor risk management parties whose products and services comprise with confidentiality commitments. process. Attestation reports (SOC 2SM reports) part of the system is assessed on a periodic and are obtained and evaluated when available. Site as-needed basis and corrective action is taken, visits and other assurance procedures are if necessary. based on the entity's vendor criteria. C1.6 Changes to confidentiality commitments and Confidentiality practices and commitments are The chief information security officer is requirements are communicated to internal and changed without the knowledge or ascent of user for changes to confidentiality practices and external users, vendors, and other third parties entities. commitments. A formal process is used to whose products and services are included in the these changes to users, related parties, system. and vendors.
Transmission of digital output beyond the of the system occurs through the use software supporting the advanced standard. C1.4 The entity obtains confidentiality commitments that are consistent with the entity’s requirements, from vendors and other third parties whose products and services comprise part of the system and have access to information. Related party and vendor personnel are unaware of the entity's confidentiality commitments. Formal information sharing agreements are in place with related parties and vendors. These agreements include confidentiality commitments applicable to that entity. Agreement terms include requirements for marking and identifying data as confidential, handling standards for confidential data in the custody of related parties and and return and disposal of confidential when no longer required. Requirements for handling of confidential are not communicated to and agreed to by related parties and vendors. Formal information sharing agreements are in place with related parties and vendors. These agreements include confidentiality commitments applicable to that entity. C1.5 Compliance with confidentiality commitments and requirements by vendors and others third parties whose products and services comprise part of the system is assessed on a periodic and as-needed basis and corrective action is taken, if necessary. Related party and vendor systems are not designed or operating effectively to comply with confidentiality commitments. Related party and vendor systems are subject to review as part of the vendor risk management process. Attestation reports (SOC 2SM reports) are obtained and evaluated when available. Site visits and other assurance procedures are based on the entity's vendor criteria. C1.6 Changes to confidentiality commitments and requirements are communicated to internal and external users, vendors, and other third parties whose products and services are included in the system. Confidentiality practices and commitments are changed without the knowledge or ascent of user entities. The chief information security officer is for changes to confidentiality practices and commitments. A formal process is used to these changes to users, related parties, and vendors.
FINAL-ED-Trust-Services-Principles.docx