Purpose
Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.
Normative
Bitkaya shall maintain, assess and test business continuity, recovery and exit plans for outsourcing arrangements, especially for critical or essential functions.
Descriptive
Plans should address deterioration or failure of service quality, provider insolvency or failure, jurisdictional risk, interdependency risk, RTO, RPO, operating capacity, adverse conditions, termination, transition to another provider or reintegration, and removal or secure handling of documents, transaction records and information.
Source reference: CBCS Guideline on Outsourcing, Article 5, Article 16, Article 21, Article 22, Article 29, Article 40 and Appendix 5.
Assurance Assertions
- Critical or essential outsourcing has documented continuity and exit plans.
- Service-provider BCP and recovery capabilities are assessed and tested.
- Exit plans define roles, resources, success criteria, transition steps and trigger indicators.
Relationships
- Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
- Policies: POL-OUT-001 Outsourcing Risk Management Manual, POL-BCM-001 Business Continuity Manual
- Processes: PRC-GRO-001 Governance Risk and Outsourcing, PRC-RSA-001 Resilience Systems and Assurance
- Procedures: PROC-OUT-004 Review and Execute Outsourcing Agreement, PROC-OUT-007 Manage Outsourcing Continuity Exit and Sub-Outsourcing, PROC-BCM-004 Develop and Maintain Continuity Strategies and Sub-Plans
- Controls: CTRL-OUT-004 Ensure Written Agreement Contains Outsourcing Safeguards, CTRL-OUT-007 Ensure Continuity Exit and Sub-Outsourcing Safeguards Exist, CTRL-BCM-004 Ensure Continuity Strategies and Sub-Plans Are Maintained
- Systems: SYS-OUT-001 Outsourcing Register
- Publications: PUB-OUT-001 Outsourcing Risk Management Manual
- Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence
Assurance
- Source verified: yes
- Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
- Wording unambiguous: approved
History
- 2026-07-25: Created from SRC-OUT-001.
- 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
- 2026-07-25: Approved outsourcing requirement for BCMS use.