[M0-D11 follow-up] Classify the first client's vendors and subservice organizations

[smiggleworth]

Note

Follow-up discovery issue created 2026-09-22 when M0-D11 #68 closed. R1-14 delivery uses the decided rules and does not wait on it.

Decision needed

Classify the first client's actual vendors against the decided materiality test, and confirm subservice treatment for each subservice organization.

Questions to answer

• Record the current vendor list and classify each vendor as material or not material, with a rationale.
• Identify the subservice organizations (for example the cloud host) and confirm carve-out, or record an inclusive exception with rationale.
• Record the CSOCs for each carved-out subservice organization with the readiness advisor.

Involve

Compliance lead, procurement or finance owner, readiness advisor.

Done when

• The classification, subservice treatment, and CSOCs are recorded with owner and date.