Every subpanel, regardless of location, should have its neutral and ground isolated, with a separate neutral and EGC brought to it. Unless it was installed in a previous code cycle when you were allowed to do otherwise. Most commonly, you keep these separate unless required to do otherwise.
Here's the limited scope of examples I can think of, for where you either are allowed or required to bond neutral and ground.
1. The main service panel, or main service disconnect. Or each service disconnect if there are multiple.
2. Hot-sequence meter sockets on service conductors, where neutral and ground are combined as the same wire.
3. Separately-derived sytems: The device with the 240.21(C) disconnect for transformer secondary conductors.
4. Separately-derived systems: a generator or battery-backup system that requires its own neutral, independent from the service neutral. Usually, there will be a switchable neutral in the transfer switch, when this happens.
5. A device that only uses either neutral or ground for instrumentation purposes, and gives you the option to omit the negligible-amp neutral, and make voltage measurements from the EGC. Technically, this isn't bonding the neutral and ground, but rather using the ground instead of the neutral, for a purpose ordinarily reserved for the neutral.
Regarding #3, the NEC gives us the option to either do this in the transformer, or in the 240.21(C) disconnect equipment, but not both. My recommendation is to do it in the transformer, and treat everything else on the secondary side as subpanes.
