What to Provide
For each sampled critical vendor, provide the vendor assessments that were performed and the vendor reports that were reviewed as part of the vendor assessments.
The evidence should demonstrate the following:
The compliance report that was reviewed for the vendor (e.g., SOC 2, Type I/II, SOC 1, Type I/II, PCI DSS, ISO 27001 Certificate)
The date the vendor review took place
The results of the review including any exceptions or risks that were identified
NOTE: The audit team will communicate sample selections once they have been finalized. Please refrain from attaching evidence in this ER until samples have been communicated.
Evidence Format
Word/PDF document, exported images in a common image file type (i.e. .jpg, .png, .pdf), Excel/.csv export from the source system
Associated Unified Control ID | Associated Framework Control |
CTRL-1109 | LCL-55 |