Purpose
Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.
Normative
Bitkaya shall maintain an updated outsourcing register and submit required CBCS compliance notifications and issue reports within the required timing.
Descriptive
The register should cover all current and ended outsourcing arrangements, distinguish critical or essential functions from other arrangements, include the information required by the guideline, support identification of concentration risk, and be available to management, supervisory functions and CBCS on request.
Source reference: CBCS Guideline on Outsourcing, Article 36, Article 37, Article 39, Article 40, Article 41, Appendix 1 and Appendix 2.
Assurance Assertions
- An outsourcing register exists and is kept current.
- The register includes required information for all arrangements and additional fields for critical or essential functions.
- Annual compliance notification and immediate material-problem reporting obligations are tracked.
Relationships
- Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
- Policies: POL-OUT-001 Outsourcing Risk Management Manual
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-001 Classify Outsourcing Arrangement, PROC-OUT-003 Obtain Outsourcing Approval and CBCS Engagement, PROC-OUT-005 Monitor Outsourcing Arrangement, PROC-OUT-006 Maintain Outsourcing Register and Reporting
- Controls: CTRL-OUT-001 Ensure Outsourcing Is Classified Before Engagement, CTRL-OUT-003 Ensure Required Approval and CBCS Engagement Is Completed, CTRL-OUT-005 Ensure Outsourcing Register Is Complete and Current, CTRL-OUT-006 Ensure Outsourcing Monitoring and Annual Review Occurs, CTRL-OUT-008 Ensure CBCS Outsourcing Reporting Is Completed
- Systems: SYS-OUT-001 Outsourcing Register
- Publications: PUB-OUT-001 Outsourcing Risk Management Manual
- Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence
Assurance
- Source verified: yes
- Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
- Wording unambiguous: approved
History
- 2026-07-25: Created from SRC-OUT-001.
- 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
- 2026-07-25: Approved outsourcing requirement for BCMS use.