Is Are sub-contractors involved in the processing of information required to conduct a gap analysis of their information security policies, procedures and controls against the Third Party Information Security Policy? part of security assessment questionnaire you required to answer?