Articles tagged “Third-party management”
A breach at your supplier: how to chain their notice to your notification
When the breach happens at your processor, notifying the supervisory authority is still your job, and your 72 hours start, in principle, when the processor tells you. What the GDPR, the EDPB and the Spanish AEPD say, what to put in the contract, what to ask on the first call and an hour-by-hour example.
I supply a bank: which DORA controls will they ask me for?
DORA does not bind ICT providers directly unless they are designated critical. But the financial entity has to pass almost everything the regulation asks of it down to you through the contract. What you will be asked for depending on the service you provide, article by article, and how to have it ready.
How to read a SOC 2 report or an ISO certificate without being caught out
A 200-page SOC 2 report and a one-page ISO 27001 certificate don't say the same thing — and neither says much on its own. What matters is the scope, the report type, and who issued it, not the stamp.
Fourth-party risk and beyond: what your inventory doesn't see
Knowing who you work with directly is the starting line, not the finish. The real exposure often sits one level down, in a subcontractor of your vendor that nobody has ever assessed.