Bank of Mauritius Guideline on Use of Cloud Services (2022) 7.2.i: Know the provider's security measures, assess vulnerabilities regularly and keep cloud controls at least as strong as on premise

What does 7.2.i require?

For material cloud services the institution knows the information security measures and controls the provider has established and any international IT standards it follows; establishes procedures for regular assessment of vulnerabilities in its IT systems with minimum standards for those assessments, such as spotting weak configurations, exposed network ports and application flaws; and makes sure the controls protecting the cloud infrastructure match or exceed those in its on-premise environment, using cloud security services to manage and monitor security where it chooses.