TPR-01 · Third Parties and Supply Chain
Third-party inventory
Third parties with access to data or systems are inventoried with an owner and a criticality judgment.
7frameworks fully address it
1partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC9.2
- ISO 27001FullA.5.19
- NIST CSFFullGV.SC-04
- PCI DSSFull12.8.1
- HIPAAFull164.308(b)(1)
- GDPRFullArt. 28
- EU AI ActPartialArt. 25 Responsibilities along the AI value chain.
- NIST AI RMFFullGOVERN 6.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Vendor register with owner, data access and criticality.
?Why it exists
You cannot assess a vendor you have not listed.
For a smaller organizationOne list, updated when someone signs a new tool.