Purpose
Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.
Normative
Bitkaya shall ensure that outsourcing arrangements protect confidential, personal and otherwise sensitive information through appropriate contractual, technical and organizational measures.
Descriptive
Controls should address confidentiality, legal data-protection obligations, data storage and processing locations, data availability and integrity, security requirements, encryption where needed, access controls, breach or adverse event reporting and secure return, deletion or transfer of data at exit.
Source reference: CBCS Guideline on Outsourcing, Article 5, Article 11, Article 13, Article 18, Article 19, Article 21, Article 29 and Appendix 5.
Assurance Assertions
- Outsourced data and systems are classified by sensitivity and required protection level.
- Contractual clauses require protection of confidential and personal data.
- Data location, access, retention, return and deletion obligations are documented.
Relationships
- Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
- Policies: POL-OUT-001 Outsourcing Risk Management Manual
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-002 Perform Outsourcing Due Diligence and Risk Assessment, PROC-OUT-004 Review and Execute Outsourcing Agreement, PROC-OUT-007 Manage Outsourcing Continuity Exit and Sub-Outsourcing
- Controls: CTRL-OUT-002 Ensure Due Diligence and Risk Assessment Is Completed, CTRL-OUT-004 Ensure Written Agreement Contains Outsourcing Safeguards, CTRL-OUT-007 Ensure Continuity Exit and Sub-Outsourcing Safeguards Exist
- Systems: not yet assigned; tracked under ISS-OUT-001
- Publications: PUB-OUT-001 Outsourcing Risk Management Manual
- Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence
Assurance
- Source verified: yes
- Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
- Wording unambiguous: approved
History
- 2026-07-25: Created from SRC-OUT-001.
- 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
- 2026-07-25: Approved outsourcing requirement for BCMS use.