Central Bank of Jordan Cloud Computing Guideline (2018) 2.3.1: Policy defines the services and data to be assigned, their classification and the chosen models

What does 2.3.1 require?

The cloud computing policy, developed and reviewed and updated periodically, identifies which services, operations and data will go to the cloud provider and classifies them by importance and sensitivity as the reference for any cloud use, the classification being the company's own responsibility; and it selects the most suitable deployment model (public, private, community or hybrid) and service model (PaaS, SaaS or IaaS) for each, based on the type of service, the classification of the information and operations involved and the assessed risk level.