Bank of Mauritius Guideline on Use of Cloud Services (2022) 7.2.iv: Obtain assurance over the hypervisor and safeguard against virtualisation risks

What does 7.2.iv require?

The institution makes sure the provider can demonstrate appropriate control of the hypervisor and of any other virtual infrastructure control it uses to manage the services, for instance by checking that hypervisor code is scanned for vulnerabilities and system logs are monitored; and it implements safeguards against virtualisation risks so that every component of a virtualisation solution is as secure and resilient as a non-virtualised one, including strong restrictions on administrator access to the hypervisor and the host operating system and policies and standards for managing virtual machine images and snapshots.