Purpose
Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.
Normative
Bitkaya shall permit sub-outsourcing only under controlled conditions that preserve regulatory compliance, access rights, audit rights, risk oversight and termination rights.
Descriptive
Sub-outsourcing controls should determine whether the sub-outsourced function is critical or essential, require subcontractors to comply with applicable obligations, preserve access and audit rights, require provider oversight, allow objection or approval where appropriate, and allow termination for undue sub-outsourcing.
Source reference: CBCS Guideline on Outsourcing, Article 23, Article 24 and Appendix 5.
Assurance Assertions
- Sub-outsourcing conditions are defined in the outsourcing agreement.
- Material sub-outsourcing changes trigger risk assessment and objection or approval rights where appropriate.
- The primary service provider remains contractually responsible for subcontractor performance and compliance.
Relationships
- Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
- Policies: POL-OUT-001 Outsourcing Risk Management Manual
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-002 Perform Outsourcing Due Diligence and Risk Assessment, PROC-OUT-004 Review and Execute Outsourcing Agreement, PROC-OUT-007 Manage Outsourcing Continuity Exit and Sub-Outsourcing
- Controls: CTRL-OUT-002 Ensure Due Diligence and Risk Assessment Is Completed, CTRL-OUT-004 Ensure Written Agreement Contains Outsourcing Safeguards, CTRL-OUT-007 Ensure Continuity Exit and Sub-Outsourcing Safeguards Exist
- Systems: SYS-OUT-001 Outsourcing Register
- Publications: PUB-OUT-001 Outsourcing Risk Management Manual
- Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence
Assurance
- Source verified: yes
- Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
- Wording unambiguous: approved
History
- 2026-07-25: Created from SRC-OUT-001.
- 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
- 2026-07-25: Approved outsourcing requirement for BCMS use.