Assess an ICT supplier and decide what evidence your organisation needs for the service, who checks it and what happens if it is missing.
In the case, the supplier provides a certificate for its data centre, but the service and a subcontractor fall outside its scope. Check what the document actually covers and compare further review, restricted use and switching supplier, taking available replacement capacity into account. Specify who obtains missing evidence, by when, and what happens if it remains unavailable. Check a later submission against its period, service and content, then revise the control plan.
Work with your own service or the substitute case. Take away your control sheet with deadlines, responsibilities and escalation steps. The method can be used internationally; sectoral and regional requirements must be established separately for the intended use.