CAIQ v4
Control STA-11
Extractive Review Standard
How to answer 'Do third-party contracts include security and confidentiality obligations equivalent to your customer commitments?' on a CAIQ
Reviewer Guidance & Pitfalls
Confirm all subprocessors and vendors with data access sign Data Processing Agreements containing equivalent confidentiality, security, and breach notification terms.
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. All subprocessors handling customer data are contractually bound by signed DPAs requiring equivalent technical and organizational security standards and 72-hour breach notification (DPA §4).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.