TPM-04—Privacy Risk Assessment

1. Inspect and validate that a process is defined and documented to review the privacy practices of service providers who access, collect, process, transfer, or store personal information on Organization's behalf. 2. Validate for a sample vendor that the reviews are conducted at the time of initial procurement and at renewal. 3. Validate for a sample non-compliance event that it was tracked to remediation.