P6.5 Third-party notification commitments: SOC 2 evidence

What P6.5 asks you to secure from your third parties

P6.5 asks you to obtain commitments from vendors and other third parties that hold or can reach your personal information, obligating them to notify you of actual or suspected unauthorized disclosures, and then to act on those notices through your own incident response procedures. If your privacy-scoped SOC 2 has a vendor list but no notification language in the contracts behind it, you have a gap that an assessor will look for. The risk is simple: when a processor is breached, the exposure is your exposure, and if nobody tells you promptly, your own record of disclosures and your own breach decisions start from the wrong date.

The points of focus under P6.5 describe two behaviors in plain terms. The first is remediating misuse of personal information by a third party, meaning you need a way to find out that a vendor used data beyond what it was allowed to and to require corrective action. The second is reporting actual or suspected unauthorized disclosures, meaning the duty to tell you should cover suspicions as well as confirmed events, since waiting for proof can cost days. Note that the points of focus are guidance for designing controls, not a checklist you must satisfy line by line.

This is hard to operate because three records that should join up usually do not. The contract owner holds the notification clause, the procurement or vendor risk team holds the inventory of who processes what, and the incident response runbook names internal roles but rarely lists external senders. Confirm that each processor with personal information appears in the inventory, that its contract states a notice obligation covering suspicions, and that the notice address or security contact is written into the runbook as an intake channel. Ask each vendor to confirm its contact and escalation path in writing, and test one notice end to end before the examination period begins.

Which vendors and data fall under P6.5 in your SOC 2 scope

P6.5 only reaches third parties that touch personal information, and only if the privacy category is in your SOC 2 at all. The cards below sort the decisions that determine which vendors, subservice organizations and sub-processors must commit to notifying you, and which ones you can leave out of this criterion.

Privacy category in or out

P6.5 is a privacy criterion, so it applies only when the privacy category is included in the examination. Security alone, covered by the common criteria CC1 to CC9, does not bring P6.5 into scope. Confirm the category decision with your CPA firm before you collect vendor commitments, because a vendor that handles personal information for a service that is not in scope may still be relevant to other common criteria, such as CC9 on vendor risk.

Vendors with personal information access

The trigger for P6.5 is access to personal information, not the existence of a contract. Map each vendor to the data it can see or store, including support tooling, analytics, email delivery and backups. A vendor that only receives anonymized or non-personal data is generally outside this criterion, but document that reasoning in your vendor inventory so an assessor can follow it.

Subservice organizations versus vendors

A subservice organization performs part of your service, such as hosting or a managed database, and its controls are typically carved out or included in your system description. A vendor sells you a tool or service that you use. Both can hold personal information, but the way you describe them in the system description changes how the auditor tests their notification commitments. Confirm the classification with your auditor early.

Cloud and infrastructure providers

Cloud hosting, object storage and managed database providers usually hold personal information, even when they never read it. Check whether their notification terms cover unauthorized disclosure of data they store, and whether they commit to notify you of suspected events, not only confirmed ones. Where you rely on a provider's published SOC report, confirm its scope covers the services you use.

Support and operations providers

Helpdesk platforms, error monitoring, customer messaging and remote access tools often receive personal information in tickets, logs or screen sessions. These vendors are easy to miss in a vendor list because they feel like tools rather than processors. Include them in the P6.5 inventory and check that their terms cover accidental exposure by their own staff or systems.

Sub-processors of your vendors

A vendor may pass personal information to its own sub-processors, which means your notification chain depends on terms you did not sign. Ask each primary vendor for its current sub-processor list, whether it flows notification duties down to those parties, and how it tells you when that list changes. Record the answer so you can show the chain to an assessor.

How an assessor tests the vendor notification commitment

The first test is documentary. The assessor wants to see that each vendor or third party with access to personal information has agreed, in writing, to tell the organization about actual or suspected unauthorized disclosures. The auditor reads the agreement itself, not a summary in a questionnaire, and checks that the clause covers both actual and suspected events and names a notice obligation rather than a general promise to cooperate. Auditors also look at whether the agreement sets out who receives the notice and how quickly it must arrive, since a clause without a route to the right internal owner is hard to act on.

Clause wording: the agreement names notice of actual or suspected unauthorized disclosure, not only confirmed security incidents.
Scope of parties: every vendor and third party with access to personal information is covered, including subprocessors where the contract flows the duty down.
Contact and channel: the clause identifies a recipient or security contact on the organization's side.
Version control: the signed version on file is the one in force during the examination period.
Exceptions in the contract: carve-outs for law enforcement requests or shorter notice periods are identified and reviewed.

Before fieldwork, check each contract against this list and record the clause location in the control matrix so the auditor can find it without a second request.

Implementing P6.5 step by step, with the output of each

This sequence turns the P6.5 expectation into working practice: vendors are identified and ranked by risk, their notice commitments are written into contracts, and a tested path carries a vendor's notice of unauthorized disclosure into the organization's incident response. Each step leaves a record an auditor can sample.

Inventory third parties with personal information access
Start with a list of every vendor, subprocessor and other third party that receives, stores, processes or can reach personal information held by the organization. Pull names from the data inventory, the processing records, cloud account and SaaS application lists, and procurement and accounts payable records, then confirm the list with system owners. The output is a third-party inventory with the data categories each party touches, the system or service involved and a named internal owner. The step is complete when system owners have signed off that no known data flow is missing.
Classify third parties by data exposure and risk
Group the inventory into tiers based on the sensitivity of the personal information involved, the volume of records, the level of access and whether the party can disclose data onward. Use the same tiering approach that drives your vendor risk reviews so notification terms are set where the exposure is highest. The output is a classification register that records each party's tier, its owner and the date of its last review. Confirm with the risk or compliance lead that the tiering method is documented and applied consistently.
Build the notification clause library
Write standard contract language that requires each third party to notify the organization of actual or suspected unauthorized disclosures of personal information. Cover what counts as a notice trigger, the information the vendor must provide, cooperation during investigation, and the vendor's duty to remediate misuse by its own staff or subprocessors. Have counsel review the wording against applicable contracts and data protection terms. The output is an approved clause library with version control, and the step closes when legal has signed off on each clause and each tier knows which clause it uses.
Update contract templates and data processing terms
Insert the approved clauses into vendor master agreements, order forms, data processing terms and subprocessor schedules. For existing vendors, prioritize the highest-tier parties and agree amendments through the contract owner. Track which agreements already contain the commitment and which still need it, since an auditor will ask for executed terms rather than templates. The output is a contract tracker showing each third party, the agreement that carries the clause and its execution status. The step is done when every high-tier party is either amended or has a documented exception with an owner.
Define how vendor notices enter incident response
Write a runbook entry that describes what happens when a third party reports an actual or suspected unauthorized disclosure. The entry should state who receives the notice, how it is logged as a potential incident, how severity is assigned, when privacy and legal staff are brought in, and how the event links to the disclosure record and breach notification duties. Align the entry with your existing incident response procedure rather than creating a parallel process. The output is an approved runbook entry with named roles and the step is complete when the incident response owner has accepted the entry.
Set the contact and escalation path
Publish the channel vendors should use to report a suspected disclosure, such as a monitored security mailbox or a documented contact list, and confirm that every tier-one and tier-two vendor has the details. Define the escalation ladder from the first receiver to the incident commander and to the privacy lead, and record who covers the role when staff are unavailable. Confirm the contact details with each vendor in writing. The output is a contact register and escalation diagram, and the step closes when each high-tier vendor has acknowledged the channel.
Test the path with a tabletop exercise
Run a tabletop exercise based on an illustrative scenario in which a vendor reports that a subprocessor exposed a set of personal records. Walk through receipt, logging, triage, escalation, vendor cooperation and the decision on notifying affected individuals and regulators. Record gaps such as missing contact details, unclear ownership or slow handoffs, and assign each one an owner and a fix date. The output is a dated test record with attendees, the scenario, decisions taken and the remediation list. Keep the record with the runbook, since it is the evidence that the path works in practice.
Record outputs and keep the evidence current
Bring the inventory, clause library, contract tracker, runbook entry and tabletop record into one evidence folder with owners and review dates. Schedule periodic reviews of the inventory and the contact register, and rerun the tabletop when the runbook or a major vendor changes. Ask your independent CPA firm early which evidence samples it expects for the P6.5 criterion, and confirm the required format before fieldwork. The step is complete when each artifact is versioned and linked to the criterion in your control matrix.

How a vendor notice becomes an incident record

A vendor notice about possible unauthorized disclosure of personal information should enter the same incident process as any other security event, and the organization should decide before the first notice arrives where that intake happens. Name one or more channels the vendor must use, such as a monitored security mailbox and a named contact, and confirm in the contract that the vendor sends notices to those channels rather than to an individual employee's inbox. Record the time the notice was received, who received it, and the vendor it came from. Those first facts are often the ones an assessor asks for when testing the P6.5 commitment, because the criterion turns on the organization acting on notices under its own incident response procedures.

Triage should answer three questions quickly: which personal information the notice concerns, which data subjects and systems are affected, and whether the event is actual or only suspected. Link the notice to the vendor record in your third-party inventory so the reviewer sees the contract terms, the notification window the vendor committed to, the data categories shared with that vendor, and the last periodic assessment of its privacy commitments. A case that cannot be tied to a vendor record usually means the inventory is incomplete, which is a finding worth tracking on its own. Set the severity from the personal information involved, not from the vendor's own description of the event.

A case tool such as DFIR-IRIS can hold the notice, the affected assets, indicators, tasks, evidence and a consolidated timeline as one record with an audit trail, and it can generate reports from that case data. Before adopting it for this purpose, confirm with your privacy and legal leads that its fields, roles and retention settings match your process, and that the evidence handling meets what your auditor will ask to see. The tool records what your team did; it does not replace the contract, which sets what the vendor must notify, how quickly, and what cooperation it owes. The DFIR-IRIS documentation is the natural starting point for checking those capabilities against your own process.

Evidence that satisfies P6.5 and how to keep it current

An auditor testing P6.5 will look for proof that vendor notice commitments exist and that notices, when they arrive, move into incident response. The cards below cover the records that prove both halves. Each one needs a named owner and a recurring check so the evidence still reflects reality when the examination window closes.

Executed contracts and data processing terms

The signed agreement is the primary proof that a third party committed to notify you. Check that the notice clause names a timeframe, a contact route and the event types it covers, including actual and suspected unauthorized disclosures. Keep a register of contract renewals and amendments, and flag any vendor whose paper predates the clause. Review the register at each contract renewal and whenever the service scope changes.

Third-party inventory tied to personal information

Auditors ask which third parties can reach personal information, so the inventory must map each vendor to the data categories and systems involved. Without that mapping, the notice commitments cannot be shown to cover the right parties. Refresh the inventory when onboarding, offboarding or changing data flows, and reconcile it against accounts-payable and access-provisioning records each quarter.

Vendor notices received with dates and actions

Every notice a vendor sends about a suspected or actual disclosure should be logged with the date received, the sender, the data affected and the decision taken. Auditors sample these entries to test whether notices were acted on promptly. Keep the log in a system with an immutable history, and confirm that staff know where to forward vendor security mail so notices do not sit in a shared inbox.

Incident tickets linked to vendor notices

A vendor notice should open or update an incident record, not just a log line. Link each ticket to the originating notice, the affected personal information and the containment, notification and remediation steps. Case tools such as DFIR-IRIS can hold assets, tasks and evidence in one record with an audit trail, which makes the chain from notice to action easy for an assessor to follow. Confirm the case tool retains records for the whole period the report covers.

Tabletop test records

Notices only satisfy P6.5 if the response process works under pressure, so run tabletop exercises that start with a vendor reporting a disclosure. Record the scenario, attendees, decisions, gaps and the follow-up owner for each gap. Repeat the exercise after significant vendor changes or incidents, and keep the outputs with the procedure version they tested. Confirm with your auditor how often they expect exercises for the period under review.

Periodic vendor review records

P6.4 and P6.5 work together: periodic reviews show that notice commitments are still honored and that corrective action followed any gap. Record each review with the evidence reviewed, such as the vendor's own assurance report or security questionnaire, the outcome and any corrective action. Schedule reviews by risk tier and trigger extra reviews after a vendor reports an event. Keep the review calendar current so the auditor can see the cadence was followed.

What meeting P6.5 costs in money and effort

This table breaks down the cost components of P6.5 by who is paid, whether the cost is one-time or recurring, and what moves it up or down. No fees or durations are given because none are supplied; use the table to structure a quote request and to decide which parts to keep in-house. Most of the spend is staff and counsel time rather than software.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it up or down
Legal review of contract language	External privacy or commercial counsel, or the in-house legal team	One-time per vendor contract, then recurring at renewal	Number of vendors with personal information access, and how many already contain notice clauses
Procurement effort to amend vendor terms	Procurement and vendor management staff, sometimes with vendor legal teams	One-time per vendor, plus renewal rechecks	Leverage over the vendor, use of a standard data processing addendum, and vendor response times
Inventory and intake path build	Engineering or GRC staff, sometimes with a consultant	One-time build, recurring upkeep as vendors change	Size of the vendor register and whether personal information flows are already documented
Routing notices into incident response	Security operations and privacy staff who own the incident procedure	One-time procedure and ticket workflow, recurring tuning	Number of intake channels and whether notices reach a single queue
Tooling for case records	Software licensing or internal hosting staff; a self-hosted open-source case tool removes license spend but not staff time	Setup once, recurring hosting and maintenance	Hosting model, integration with existing ticketing, and staff time to administer the platform
Tabletop testing of third-party notices	Internal incident responders, privacy staff, and sometimes an outside facilitator	Recurring, usually at least once per review cycle	Scenario complexity, number of teams involved, and whether vendors take part
Auditor sampling and evidence requests	Internal staff preparing evidence; the independent CPA firm performs the sampling	Recurring each examination period	Number of vendors in the sample, quality of contract records, and how quickly notices are logged

Who owns vendor notice commitments and who helps

Your organization owns the commitment. Legal decides which clauses vendors must accept and how notice obligations fit with your customer contracts and regulatory duties. Procurement puts those clauses into purchase terms and tracks which vendors have signed. The security owner decides how a vendor notice enters incident response, and the privacy owner decides which vendors touch personal information and what counts as an unauthorized disclosure for your program.

Legal: approves the notice clause, the timing language and any carve-outs, and signs off on exceptions.
Procurement: adds the clause to order forms and master agreements and records the signed version against each vendor.
Security owner: routes vendor notices into the incident process and confirms who receives them out of hours.
Privacy owner: maintains the list of vendors with access to personal information and reviews it when processing changes.
Management: accepts residual risk where a vendor refuses the clause.

Before the audit period starts, confirm that each role has a named person and that the decisions are written down, because the auditor will ask who approved each exception.

Where organizations fall short on vendor notification

Most P6.5 gaps are not missing intent. They are commitments that were never written down, notices that land in the wrong place, and no record that the process works. The cards below cover the failure points an assessor is most likely to probe, and the fix for each.

Vendors onboarded before the clause

Many vendors with access to personal information were signed before the organization wrote a notification requirement into its contracts. Those vendors may never have committed to tell you about actual or suspected unauthorized disclosures. Start by listing every third party that touches personal information, then compare each contract against the P6.5 expectation. Where the clause is missing, add it through an addendum or at renewal, and record the date each vendor accepted it. Ask your counsel which agreements need amendment and which can rely on existing terms.

Clauses with no timeframe or channel

A notice clause that says a vendor will report incidents "promptly" gives an assessor nothing to test and gives your team nothing to act on. The clause should name who must notify, what triggers a notice (actual or suspected), how fast the notice must arrive, and the address or system where it goes. Review existing language for these four elements. Where your regulators set their own deadlines, make sure the vendor clock is shorter than yours so you can meet your own reporting duty.

Notices sent to a sales inbox

Vendors often send security notices to whoever signed the contract, such as a sales contact, account manager or general support mailbox. Those messages can sit unread for days. Publish a dedicated security notification address or portal in the contract and in your vendor records, and confirm it routes to people on call. Test it by sending a sample notice from a vendor-side account and measuring how long it takes to reach an accountable owner. Keep the test result as evidence.

Vendor notices not linked to tickets

A vendor notice that never becomes a case cannot be traced through your incident response procedure. Each notice should open a tracked incident or case, record the vendor, the affected personal information and the time received, and carry the assigned owner through to closure. Some teams use an incident case management tool for this, such as DFIR-IRIS, which keeps assets, indicators, tasks and evidence in one case record with an audit trail. Whatever tool you choose, confirm that a notice can be traced from the inbox to the closed record.

No evidence the process was tested

A written procedure is not evidence that it works. Assessors look for records that show notices were received, assessed and acted on, and for periodic checks that vendors still meet their commitments. Run a tabletop exercise where a simulated vendor notice enters the process, and keep the agenda, attendees and actions. Where vendors have reported incidents, keep the notice, the response and any corrective action together. Ask your auditor which samples they expect to see before fieldwork begins.

Questions about P6.5 cost, effort and outsourcing

How much effort does P6.5 add to a SOC 2 examination?

For most organizations the main effort is contract review and vendor inventory, not new technology. P6.5 asks the organization to obtain commitments from vendors and other third parties with access to personal information, so the work scales with how many such parties exist and how their contracts are written. The effort drivers are the number of vendors that touch personal data, how many already have notification language in their agreements, how many contracts must be renegotiated or amended, and how cleanly the notices can be routed into the incident response procedure. An organization with a short, well-documented vendor list will spend far less time than one with hundreds of informal integrations spread across teams. Ask your team to size the work from the vendor inventory before anyone quotes it.

Can we handle P6.5 in-house without an outside partner?

Yes, many organizations do, provided they have a named owner in legal or procurement, a current list of third parties with access to personal information, and an incident response procedure that someone actually runs. The steps that usually stay in-house are contract clauses, vendor sign-off and the decision about what counts as a notifiable event for each supplier. Outside help tends to be useful for building the vendor inventory, wiring vendor notices into ticketing or case management, and preparing the evidence folder the auditor will request. Be clear about roles: the organization owns its controls and contracts, an implementation partner prepares systems and evidence, and only the independent CPA firm issues the SOC 2 report.

What should we ask a partner to include in a quote for P6.5 work?

Ask for a written scope that names the deliverables, not just hours. A useful quote states which systems and vendors are in scope, whether the partner will draft clause language or only review yours, how vendor notices will be routed into incident response, which tools will be configured, and what evidence package will be handed over at the end. Ask who does each task, whether counsel review is included or must be bought separately, and what the partner needs from your team to keep the work on schedule. Confirm what happens if the vendor inventory is larger than expected. DeployOpen works from a written scope agreed before work starts, and prices follow from that scope.

Will the auditor test every vendor's notification commitment?

Usually not every vendor one by one, but the auditor will expect the organization to show how it selected the vendors it relied on and how it tested the commitments it obtained. The sample and the depth of testing depend on the system description, the risk the organization assigned to each third party, and the criteria in scope. Auditors ask for the vendor inventory, the contract or addendum language, the process for receiving and acting on notices, and records showing a notice was handled. If your organization cannot produce those records for the vendors that matter most, the examination will raise questions regardless of how many contracts exist. Confirm the expected sample approach with your CPA firm early.

How often should vendor notification commitments be reviewed?

Review them on a recurring schedule and whenever something changes. A common pattern is an annual review of the vendor inventory and contract terms, plus a review at renewal, when a vendor changes its subprocessors, after an incident involving a third party, and when your product begins sending personal information to a new supplier. The right cadence depends on your risk assessment and your vendor population. Record each review with a date, the reviewer and the outcome so that the evidence is ready for the examination period, especially for a Type 2 report that covers a period of time.

What should we confirm about our vendor contracts with counsel?

Ask counsel to confirm that each relevant contract requires the vendor to notify you of actual or suspected unauthorized disclosures of personal information, sets a notification window you can meet with your own obligations, and names who receives the notice. Counsel should also check how the clause interacts with your breach notification duties to customers and regulators, whether it covers subprocessors, whether the vendor must cooperate with your investigation, and what remediation or corrective action applies. Confirm which contracts are excluded and why. Legal review determines the wording, so treat any template from an outside party as a starting point for counsel, not a finished clause.

What recurring costs should we expect after the first P6.5 setup?

The recurring costs are mostly people time and the audit itself. Someone must maintain the vendor inventory, process notices, review new suppliers before they receive personal information, and keep records for the examination period. Ongoing support, upgrades and monitoring can be contracted as a retainer if the organization wants a partner to stay involved. The CPA firm's fees for each examination are a separate cost, and the amount depends on scope, system complexity and the report type. Ask any provider to separate one-time setup from recurring work so you can budget each part on its own.

Where to read the criterion itself

The authoritative text for P6.5 is the AICPA's *2017 Trust Services Criteria with revised points of focus (2022)*, published by the AICPA. Read P6.5 there, in the 2022 points-of-focus version, rather than relying on summaries, including this one. The criterion sits in the privacy category, so the privacy category must be in your SOC 2 scope before P6.5 applies to your examination. Pull the current PDF from the AICPA 2017 Trust Services Criteria page and keep a dated copy in your audit folder so the version your auditor tests against is the version your team designed to.

Read the criterion's wording and its points of focus side by side. The points of focus for P6.5 cover remediating misuse of personal information by a third party and reporting actual or suspected unauthorized disclosures. Points of focus are characteristics that help you design and evaluate controls, not separate requirements, so you do not need to address each one, but you should record why any point you skip does not fit your environment. For each vendor that receives personal information, write down the notice clause you expect, the recipient of that notice inside your organization, and the incident procedure that picks it up.

The NIST Privacy Framework crosswalk to the AICPA 2017 Trust Services Criteria from 2023 is a useful second read. It shows how privacy framework outcomes line up with the criteria, which helps your privacy and security teams agree on who owns third-party notice handling. Use it as a navigation aid only. The crosswalk does not replace the criteria, and an assessor will test against the AICPA text. Confirm with your CPA firm which version and which points of focus they will use for your report period before you finalize your control matrix.

How DeployOpen prepares P6.5 evidence

DeployOpen helps organizations prepare the systems, records and workflows that show vendor notification commitments are in place and routed into incident response. The organization owns its criteria and vendor relationships, and only an independent CPA firm issues the SOC 2 report.

How we scope

Engagements are fixed-scope, with the list of vendors and third parties that hold personal information agreed in writing.
The written scope names which notification clauses, contracts and vendor records are covered for P6.5 commitments.
Scope also sets which incident response paths receive vendor notices and who owns each step.

How we build

We configure case management so a vendor notice opens a tracked incident with assets, tasks and evidence attached.
We set up triage rules that route notices from vendor channels into the same workflow as internal alerts.
We document the commitment register and the escalation steps the organization will follow when a notice arrives.

How we hand over

You receive documented procedures, configuration records and a sample case trail for the auditor to review.
Evidence is packaged with dates, owners and chain of custody so each notice can be traced end to end.
Handover includes a walkthrough so your team can run the process without us and answer auditor questions.

How we support

Ongoing support and periodic checks of the vendor notification register are available as a retainer.
We can review evidence before fieldwork so gaps are found while the observation period is still open.
Changes to vendors or tooling can be assessed and documented as they happen, under the agreed scope.