# OUT-07 Third-party integration review

Domain: OUT Output Integrity & Supply Chain · HI-AAF v1.3 · Public review · https://humanintel.net/standard/out/out-07

Third-party integrations are reviewed periodically for continued necessity, security posture, and contractual terms.

Third-party integrations identified in OUT-06 are reviewed at a documented cadence for continued necessity, security posture, and contractual terms. Integrations that are no longer needed are decommissioned. Integrations with degraded security posture trigger remediation or replacement. This ongoing review prevents integration sprawl and stale supply-chain risk.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for OUT-07: Reviews are conducted at the documented cadence; review records are retained; at least one integration has been decommissioned or remediated as a result of review; no integration is past its review date.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Reviews are conducted at the documented cadence.
- Review records are retained.
- At least one integration has been decommissioned or remediated as a result of review.
- No integration is past its review date.

## Framework mappings

- NIST AI RMF: MANAGE 3.2
- SOC 2 (TSC): CC9.2
- EU AI Act: Art. 15(2)
- Singapore: MAIGF Trusted Development and Deployment

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites OUT-06 Third-party integration inventory: https://humanintel.net/standard/out/out-06

## Cite this control

Human Intelligence. HI-AAF v1.3, OUT-07 Third-party integration review. Public review edition, July 2026. https://humanintel.net/standard/out/out-07