# OUT-06 Third-party integration inventory

Domain: OUT Output Integrity & Supply Chain · HI-AAF v1.3 · Public review · https://humanintel.net/standard/out/out-06

A third-party integration inventory is maintained (MCP servers, plugins, tool providers, vector databases, embedding providers, external agents). Each integration carries a documented risk assessment.

Beyond model providers, the organization maintains an inventory of all third-party integrations: MCP servers, plugins, tool providers, vector databases, embedding providers, external agents. Each integration carries a documented risk assessment. This inventory is the supply-chain complement to the model provider inventory in OUT-05.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for OUT-06: Inventory exists and covers all third-party integrations; risk assessments are documented per integration; the inventory is reviewed at a documented cadence; new integrations go through the risk-assessment process before activation.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Inventory exists and covers all third-party integrations.
- Risk assessments are documented per integration.
- The inventory is reviewed at a documented cadence.
- New integrations go through the risk-assessment process before activation.

## Framework mappings

- NIST AI RMF: MANAGE 3.1
- OWASP LLM Top 10: LLM03
- SOC 2 (TSC): CC9.2
- EU AI Act: Art. 15(2)
- Singapore: MAIGF Trusted Development and Deployment

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites OUT-05 Model provider inventory: https://humanintel.net/standard/out/out-05
- Cited by OUT-07 Third-party integration review: https://humanintel.net/standard/out/out-07
- Cited by MAS-09 External agent trust boundaries: https://humanintel.net/standard/mas/mas-09

## Cite this control

Human Intelligence. HI-AAF v1.3, OUT-06 Third-party integration inventory. Public review edition, July 2026. https://humanintel.net/standard/out/out-06