# Deploy reconciliation

URL: /systems/trust-and-governance/controls/deploy-reconciliation · Id: `control:deploy-reconciliation`

> Only Versions a merged Change points to run, and any other running fingerprint opens an Incident.

Only [Versions](/business/nouns/version) a merged [Change](/business/nouns/change) points to run, and any other running fingerprint opens an [Incident](/business/nouns/incident).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.8](/systems/trust-and-governance/criteria/soc2/cc6-8) | The entity prevents or detects the introduction of unauthorized or malicious software. |
| [SOC2 CC7.1](/systems/trust-and-governance/criteria/soc2/cc7-1) | The entity uses detection and monitoring to identify configuration changes and newly discovered vulnerabilities. |
| [SOC2 CC8.1](/systems/trust-and-governance/criteria/soc2/cc8-1) | The entity authorizes, designs, develops, configures, documents, tests, approves and implements changes to infrastructure, data, software and procedures. |
| [ISO27001 A.8.9](/systems/trust-and-governance/criteria/iso27001/a-8-9) | Configurations, including security configurations, are established, documented, implemented, monitored and reviewed. |

## Implemented by
- [Release](/workflows/processes/release)
- [Incident response](/workflows/processes/incident-response)
- [Repositories](/code/systems/repositories)
- [Monitoring](/code/systems/monitoring)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every running fingerprint across every namespace, sampled each hour. |
| Assert | Each fingerprint matches a Version a merged Change points to, or an Incident opened within one hour. |

## Owner
[Reliability Engineer](/agents/engineering/reliability-engineer), [Engineering Team](/agents/engineering).

## Example
A hand-patched worker for an invoice-parsing API runs a fingerprint no merged Change points to. Within the hour an Incident opens, and the worker is replaced by the merged Version.