Under active development — Content is continuously updated and improved

TPM-05—Third-Party Contract Requirements

Weight: 10

>Control Description

Mechanisms exist to require contractual requirements for cybersecurity and data protection requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).

>Cross-Framework Mappings

NIST SP 800-53 r5

NIST CSF 2.0

PCI DSS v4.0.1

CIS Controls v8

SOC 2 TSC

CMMC v2.0

NIST SP 800-171

Canada ITSP 10.171

Australia ISM

China Cybersecurity Law

India DPDPA

India SEBI Guidelines

New Zealand HISF

New Zealand HISF Suppliers

Saudi Arabia IoT Guidelines

Saudi Arabia PDPL

UK DEF STAN 05-138

CIS Controls v8.1 (Detailed)

ISO 27002:2022

ISO 27701

ISO 42001:2023 (Detailed)

NAIC Model Law 668

NIST SP 800-161

NIST SP 800-171 Rev 3

NIST SP 800-171A Rev 3

A.03.16.03.ODP[01]

NIST SP 800-218 SSDF

NIST AI 600-1

TISAX

Data Privacy Management Principles

45 CFR 155.260

155.260(b)(2)(i)

155.260(b)(2)(ii)

155.260(b)(2)(iii)

155.260(b)(2)(iv)

FBI CJIS

US Data Privacy Framework

CISA CPG

CMMC 2.0 Level 1

FCA CRM

609.930(c)(5)(ii)

GLBA (16 CFR 314)

HIPAA Simplification 2013

§ 164.308(b)(1)

§ 164.308(b)(2)

§ 164.308(b)(3)

§ 164.314(a)(2)(iii)

§ 164.314(b)(1)

§ 164.314(b)(2)(i)

§ 164.314(b)(2)(ii)

§ 164.314(b)(2)(iii)

§ 164.502(a)(4)(i)

§ 164.502(a)(4)(ii)

§ 164.502(e)(1)(i)

§ 164.502(e)(2)

§ 164.504(e)(2)(i)

§ 164.504(e)(2)(i)(A)

§ 164.504(e)(2)(i)(B)

§ 164.504(e)(2)(ii)(J)

§ 164.504(e)(4)(i)(B)(ii)(B)(1)

§ 164.504(e)(4)(i)(B)(ii)(B)(2)

§ 164.504(f)(1)(i)

§ 164.504(f)(2)(i)

§ 164.504(f)(2)(ii)

§ 164.504(f)(2)(ii)(A)

§ 164.504(f)(2)(ii)(B)

§ 164.504(f)(2)(ii)(C)

§ 164.504(f)(2)(ii)(D)

§ 164.504(f)(2)(ii)(E)

§ 164.504(f)(2)(ii)(F)

§ 164.504(f)(2)(ii)(G)

§ 164.504(f)(2)(ii)(H)

§ 164.504(f)(2)(ii)(I)

§ 164.504(f)(2)(ii)(J)

§ 164.504(f)(2)(iii)(A)

§ 164.504(f)(2)(iii)(B)

§ 164.504(f)(2)(iii)(C)

§ 164.504(f)(3)(i)

§ 164.504(f)(3)(ii)

§ 164.504(f)(3)(iii)

§ 164.504(f)(3)(iv)

SEC Cybersecurity Rule

17 CFR 229.106(b)(1)(iii)

NY DFS 23 NYCRR 500

Oregon CPA

Section 6(2)(a)

Section 6(2)(b)

Section 6(2)(c)

Section 6(2)(d)

Section 6(2)(e)

Section 6(2)(f)

Section 6(2)(g)

Section 6(2)(h)

Texas CDPA

Virginia CDPA

Ask AI

Configure your API key to use AI features.