Bank of Mauritius Guideline on Use of Cloud Services (2022) 10.1.i: Set, agree and test business continuity requirements for material services

What does 10.1.i require?

For material cloud services the institution develops and documents, and where appropriate agrees with the provider, its continuity requirements (disaster recovery plans, recovery time and recovery point objectives, the most data it can afford to lose, incident communication plans and how often the plans are tested); it makes sure the provider tests its own continuity plans regularly, ideally with certification or mapping to international standards; it builds in system resiliency and network redundancy for disasters and tests them regularly; and it makes sure the provider is equipped, in plans and resources, to keep the institution operating, including recovery and resumption.