Obtain CBCS Approval for Critical or Material Outsourcing

Purpose

Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.

Normative

Bitkaya shall notify or engage the CBCS before outsourcing critical or essential functions or establishing material outsourcing arrangements, and shall obtain required CBCS approval before engagement.

Descriptive

The guideline expects timely supervisory dialogue, prior approval for critical or essential functions, and a permission request at least sixty days before engaging in such outsourcing, including the draft outsourcing agreement.

Source reference: CBCS Guideline on Outsourcing, Article 1, Article 36 and Article 40.

Assurance Assertions

• Critical or essential outsourcing is identified before engagement.
• CBCS notification, dialogue or permission is completed within the required timing.
• Draft agreements and requested information are available for CBCS review.

Relationships

• Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
• Policies: POL-OUT-001 Outsourcing Risk Management Manual
• Process: PRC-GRO-001 Governance Risk and Outsourcing
• Procedures: PROC-OUT-001 Classify Outsourcing Arrangement, PROC-OUT-003 Obtain Outsourcing Approval and CBCS Engagement, PROC-OUT-006 Maintain Outsourcing Register and Reporting
• Controls: CTRL-OUT-001 Ensure Outsourcing Is Classified Before Engagement, CTRL-OUT-003 Ensure Required Approval and CBCS Engagement Is Completed, CTRL-OUT-008 Ensure CBCS Outsourcing Reporting Is Completed
• Systems: SYS-OUT-001 Outsourcing Register
• Publications: PUB-OUT-001 Outsourcing Risk Management Manual
• Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence

Assurance

• Source verified: yes
• Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
• Wording unambiguous: approved

History

• 2026-07-25: Created from SRC-OUT-001.
• 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
• 2026-07-25: Approved outsourcing requirement for BCMS use.