Purpose
Translate the CBCS IT framework and service-management guidance into a testable BCMS requirement for technology change, acquisition and outsourced IT services.
Normative
Bitkaya shall manage the development, acquisition, implementation and outsourcing of technology services under approved governance, risk and change controls, including major changes in the IT environment and third-party service arrangements.
Descriptive
This requirement captures the IT Framework Memorandum topics that cover development and acquisition, outsourced technology services and reporting of major IT changes, together with service-management and governance expectations that depend on those controls.
Source reference: IT Framework Memorandum for Supervised Institutions; Provisions and Guidelines for Information Technology Service Management; Provisions and Guidelines for the Governance of Enterprise Information Technology.
Assurance Assertions
- Major IT changes are assessed and approved before implementation.
- Development, acquisition and outsourced IT services are controlled.
- Technology change records support governance and audit.
Relationships
- Source: SRC-IT-001 CBCS IT Governance, Security, Continuity and Testing Guidelines
- Policy: POL-IT-001 IT and Cybersecurity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-IT-008 Manage Technology Change Acquisition and Outsourced IT Services
- Control: CTRL-IT-008 Ensure Technology Change Acquisition and Outsourced IT Services Are Controlled
- Systems: SYS-KYT-001 Crystal Intelligence Blockchain Analytics, SYS-IT-001 Odoo Automated Compliance Monitoring
- Publications: PUB-KYT-002 Crystal Intelligence Calibration and Change Record, PUB-IT-001 Automated Compliance Monitoring Controls in Odoo SOP, PUB-TRAIN-005 IT Compliance Training, PUB-KYT-001 Odoo Pre-Trade and Post-Trade KYT Controls SOP, PUB-OTC-001 Bitkaya Principal OTC Service Flows Memo
Assurance
- Source verified: yes
- Implementation linked: yes
- Wording unambiguous: review
History
- 2026-07-26: Created from SRC-IT-001.
- 2026-07-26: Linked to the IT process, procedure and control set.
- 2026-07-26: Added the missing IT policy metadata mapping.