{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:f363048ac9ad6bf8d1664397cb2ca7ee815450822567ec5ffd7c1027bf080c2c","slug":"grc-subservice-organization-third-party-personnel-oversight","url":"/assets/agent_workflow-grc-subservice-organization-third-party-personnel-oversight-893e80ef.3bdb5ee08a4a750c.json"},"kind":"record","record":{"attributes":{"department":"procurement","domain":"grc","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=grc-subservice-organization-third-party-personnel-oversight","description":"Subservice Organization & Third-Party Personnel Oversight as a checkpoint graph. Anchor: each run enriches the existing subservice-organization **Vendor** register entry for one provider - the workflow instance and every step document attach to it, and it is never recreated (initial vendor selection and onboarding due diligence are out of scope). In scope: the subservice organizations and third-party suppliers whose services support user-entity control objectives or whose personnel access the organization's systems or data - reconciling and enriching their Vendor register entries, verifying subservice and personnel-security contract terms, reviewing assurance (SOC) reports and mapping complementary user-entity controls (CUECs) to internal Control items, routing exceptions to tracked Issue items, collecting third-party personnel-compliance evidence, monitoring vendor performance, and running the quarterly issue follow-up through to closure. Out of scope: initial vendor selection and onboarding due diligence, and the organization's own internal personnel controls. Upstream: no workflow feeds it - it is built from the existing Vendor register, the prior cycle's archived vendor file, open Issue items, and the internal Control inventory, plus contracts, SOC reports, and performance data uploaded as evidence. Downstream: self-contained - no single workflow consumes its output; the archived, auditor-ready vendor file is the durable evidence record. It runs on the annual per-vendor cycle with quarterly issue follow-up.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=grc-subservice-organization-third-party-personnel-oversight","capabilities":[],"controls":["UC-ACCESS-21","UC-HR-05"],"domains":["grc"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:f363048ac9ad6bf8d1664397cb2ca7ee815450822567ec5ffd7c1027bf080c2c","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-subservice-organization-third-party-personnel-oversight","standards":["soc1","nist-800-53","iso-27001"],"teams":["procurement","hr"]},"id":"wf:G24","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AG24","slug":"grc-subservice-organization-third-party-personnel-oversight","sourceIds":["iso-27001","nist-800-53","soc1"],"sourceUrl":null,"title":"Subservice Organization & Third-Party Personnel Oversight","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:109ae7a3281ce93df48101168a36f078b44d0abbb825f5f2728c9c2eab4e869b","properties":{},"sourceDetailPath":"/data/v1/records/wf-g24-104b8991.json","sourceId":"wf:G24","targetDetailPath":"/data/v1/records/uc-uc-hr-05-4049a32e.json","targetId":"uc:UC-HR-05","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:655a4dbde047661949b09ea891bf5bb39b0271c054f57adb428792555462aca6","properties":{},"sourceDetailPath":"/data/v1/records/wf-g24-104b8991.json","sourceId":"wf:G24","targetDetailPath":"/data/v1/records/uc-uc-access-21-14f45683.json","targetId":"uc:UC-ACCESS-21","type":"operates"}],"schemaVersion":1}