Security in third party agreements, B
This variant focuses on agreements that process personal information.
What the published 2016 guidance says
This variant focuses on agreements that process personal information. It identifies the requirements each agreement must address, such as availability, response time, help desk level and maintenance level, then reports the share addressed and the trend against the previous value. Illustrative targets are above 0.9 for the level and stable or rising for the trend. Evidence is the requirement count per agreement. It is collected monthly, analysed and reported quarterly, and reviewed every two years. The contract office owns it, security staff collect, and the management system and security leads are clients.
What it means in practice
This variant focuses on agreements that process personal information and separates the level from the trend. Both matter: a high average that is falling is a different position from a low average that is rising. Report the requirement set you tested against.
Status of this record. For B.32, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the agreements, the requirement set and the review dates. Calculate the level and the trend. Report both. Flag any agreement that processes personal information and falls below the threshold.
Evidence an assessor asks for
- Supplier relationshipsPolicy list of standard security requirements for personal-data processors
- PrivacyAgreement-by-agreement coverage records
- Supplier relationshipsQuarterly trend
The question an assessor will ask
An assessor will ask for policy list of standard security requirements for personal-data processors. The test for B.32 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Personal-data processing agreements not identified as a distinct population
- Standard requirements undefined, so coverage cannot be scored
Before the next review
Before the next review, test this against one live record: personal-data processing agreements not identified as a distinct population.
What to check when the revision publishes
When DIS 27004 is published, compare the B.32 Security in third party agreements, B record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.