CAIQ v4
Control STA-05
Extractive Review Standard
How to answer 'Do you maintain a list of subprocessors?' on a CAIQ
Reviewer Guidance & Pitfalls
Point to the actual published subprocessor list (usually a DPA annex or a public URL) rather than describing the policy abstractly. State the notice period for subprocessor changes — reviewers cross-check this against the DPA clause number.
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. Current subprocessors are published at [URL] and updated within 5 business days of any change; customers receive 30 days' notice before a new subprocessor is added (DPA §4).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.