Purpose
Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.
Normative
Bitkaya shall monitor, review, audit and control outsourcing arrangements on a risk-based basis throughout their lifecycle.
Descriptive
Monitoring should include assigned responsibilities, frequent provider engagement where needed, periodic reviews, reporting to management and supervisory functions, escalation of adverse developments, prompt remedial action, audit planning, review of third-party certifications and the ability to perform individual audits when required.
Source reference: CBCS Guideline on Outsourcing, Article 30, Article 31, Article 32, Article 33, Article 34 and Article 35.
Assurance Assertions
- Each outsourcing arrangement has assigned monitoring responsibility.
- Monitoring reports are reviewed by management and shared with the supervisory function where appropriate.
- Audit and certification evidence is reviewed for scope, quality, currency and operational effectiveness.
Relationships
- Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
- Policies: POL-OUT-001 Outsourcing Risk Management Manual, POL-BCM-001 Business Continuity Manual
- Processes: PRC-GRO-001 Governance Risk and Outsourcing, PRC-RSA-001 Resilience Systems and Assurance
- Procedures: PROC-OUT-005 Monitor Outsourcing Arrangement, PROC-OUT-006 Maintain Outsourcing Register and Reporting, PROC-BCM-007 Review Audit and Improve BCM
- Controls: CTRL-OUT-006 Ensure Outsourcing Monitoring and Annual Review Occurs, CTRL-OUT-008 Ensure CBCS Outsourcing Reporting Is Completed, CTRL-BCM-007 Ensure BCM Review Audit Records and Improvements Are Maintained
- Systems: SYS-OUT-001 Outsourcing Register
- Publications: PUB-OUT-001 Outsourcing Risk Management Manual
- Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence
Assurance
- Source verified: yes
- Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
- Wording unambiguous: approved
History
- 2026-07-25: Created from SRC-OUT-001.
- 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
- 2026-07-25: Approved outsourcing requirement for BCMS use.