# Regulatory Standards — Vendor Monitoring Program

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 28(1)**: The controller's obligation to use only processors with "sufficient guarantees" is ongoing. Initial due diligence does not discharge this obligation — continuous monitoring is required.

- **Article 5(2)**: Accountability requires controllers to demonstrate compliance at all times, including demonstrating ongoing oversight of processors.

- **Article 24(1)**: Controllers must implement measures proportionate to risk and demonstrate their effectiveness, which requires periodic review.

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

- **Paragraph 87**: "The controller's assessment obligation is ongoing — not limited to initial engagement. The controller should review at appropriate intervals whether the processor still provides sufficient guarantees."

- **Paragraph 88**: Indicators that may trigger reassessment include: changes in the nature of processing, changes in the processor's organizational structure, data breaches, changes in applicable law, and changes in the processor's certification status.

## Industry Standards

### ISO 27001:2022 — Information Security Management

- **A.5.19 — Information security in supplier relationships**: "Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of supplier's products or services." Includes ongoing monitoring.

- **A.5.22 — Monitoring, review and change management of supplier services**: "The organization shall regularly monitor, review and manage change in supplier information security practices and service delivery."

### NIST Cybersecurity Framework 2.0

- **GV.SC (Govern — Supply Chain Risk Management)**: Establish and monitor supply chain risk management processes
- **ID.SC-04**: Monitor suppliers and third parties to verify compliance with requirements

## Supervisory Authority Guidance

### Danish DPA — Ongoing Processor Oversight (2021)

The Datatilsynet conducted inspections of municipalities' processor oversight and found:
- Many controllers conducted initial assessments but no ongoing monitoring
- Annual reassessment is a minimum expectation for significant processing
- Controllers must have documented procedures for continuous oversight

### Bavarian DPA — Processor Monitoring Expectations (2022)

Recommends:
- Risk-based monitoring frequency
- Combination of questionnaires, documentation review, and audit
- Tracking of monitoring activities for accountability
- Documented escalation procedures for identified non-compliance