Third-party processors: Implementation and evidence
Specifies data flows, enforcement points, records, tests, audit evidence, and operational ownership for third-party processors. It fixes adoption boundaries and observable failure evidence while keeping environment-specific limits configurable.