In which a sub-processor is engaged, the exact same data protection obligations in the contract among the controller and processor needs to be imposed to the sub-processor by way of contract or other “organisational measures.”[45] The processor will remain entirely liable into the controller for performance of your sub-processor’s obligations. https://fismacomplianceinusa.blogspot.com/