Upstream review
Every upstream is declared on its Change, and each one observed in use has a current security report on file.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC9.2 | The entity assesses and manages risks associated with vendors and business partners. |
| SOC2 CC6.4 | The entity restricts physical access to facilities and protected information assets to authorized personnel. |
| SOC2 CC6.5 | The entity removes protections over physical assets only after the data on them can no longer be recovered. |
| SOC2 P6.4 | The entity obtains privacy commitments from vendors and third parties with access to personal information, and assesses their compliance. |
| SOC2 P6.5 | The entity obtains commitments from vendors and third parties to tell it of any unauthorized disclosure of personal information. |
| ISO27001 A.5.19 | Processes manage the information security risks of using supplier products and services. |
| ISO27001 A.5.22 | Supplier security practices and service delivery are monitored, reviewed and managed through change. |
| ISO27001 A.5.23 | Acquiring, using, managing and exiting cloud services follow the information security requirements. |
| HIPAA 164.310(a)(1) | Physical access to electronic information systems and the facilities that house them is limited to authorized access. |
| GDPR Art.28 | A controller uses only processors that give sufficient guarantees, bound by a contract with the required terms. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every upstream called through the gateway in the report period. |
| Assert | Each has a declaring Change, an Agreement with security and breach-notice terms, and an unexpired security report File. |
Owner
Compliance Officer, Legal Team.
Example
A Change adds an e-signature upstream to a home-appraisal service. It merges with the Agreement's breach-notice terms and the upstream's current security report on file.