# Upstream review

URL: /systems/trust-and-governance/controls/upstream-review · Id: `control:upstream-review`

> Every upstream is declared on its Change, and each one observed in use has a current security report on file.

Every upstream is declared on its [Change](/business/nouns/change), and each one observed in use has a current security report on file.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC9.2](/systems/trust-and-governance/criteria/soc2/cc9-2) | The entity assesses and manages risks associated with vendors and business partners. |
| [SOC2 CC6.4](/systems/trust-and-governance/criteria/soc2/cc6-4) | The entity restricts physical access to facilities and protected information assets to authorized personnel. |
| [SOC2 CC6.5](/systems/trust-and-governance/criteria/soc2/cc6-5) | The entity removes protections over physical assets only after the data on them can no longer be recovered. |
| [SOC2 P6.4](/systems/trust-and-governance/criteria/soc2/p6-4) | The entity obtains privacy commitments from vendors and third parties with access to personal information, and assesses their compliance. |
| [SOC2 P6.5](/systems/trust-and-governance/criteria/soc2/p6-5) | The entity obtains commitments from vendors and third parties to tell it of any unauthorized disclosure of personal information. |
| [ISO27001 A.5.19](/systems/trust-and-governance/criteria/iso27001/a-5-19) | Processes manage the information security risks of using supplier products and services. |
| [ISO27001 A.5.22](/systems/trust-and-governance/criteria/iso27001/a-5-22) | Supplier security practices and service delivery are monitored, reviewed and managed through change. |
| [ISO27001 A.5.23](/systems/trust-and-governance/criteria/iso27001/a-5-23) | Acquiring, using, managing and exiting cloud services follow the information security requirements. |
| [HIPAA 164.310(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-310-a-1) | Physical access to electronic information systems and the facilities that house them is limited to authorized access. |
| [GDPR Art.28](/systems/trust-and-governance/criteria/gdpr/art-28) | A controller uses only processors that give sufficient guarantees, bound by a contract with the required terms. |

## Implemented by
- [Provider wiring](/systems/integrations/provider-wiring)
- [Connect providers](/systems/integrations/provider-wiring/connect-providers)
- [Contracting](/workflows/processes/contracting)
- [Integrations](/code/platform/integrations)
- [Agreements](/systems/agreements)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every upstream called through the gateway in the report period. |
| Assert | Each has a declaring Change, an Agreement with security and breach-notice terms, and an unexpired security report File. |

## Owner
[Compliance Officer](/agents/legal/compliance-officer), [Legal Team](/agents/legal).

## Example
A Change adds an e-signature upstream to a home-appraisal service. It merges with the [Agreement](/business/nouns/agreement)'s breach-notice terms and the upstream's current security report on file.