Central Bank of Jordan Cloud Computing Guideline (2018) 2.5.3: Contracts require cooperation with third parties, consent to subcontracting, incident notification and the Central Bank's supervisory access

What does 2.5.3 require?

Contracts oblige the provider to cooperate with any third party the company engages whose work overlaps with the assigned services; require that the company is told immediately and asked for permission if the provider engages a third party for the assigned service, with the provider remaining responsible for the service and for the agreed controls, security and operational requirements; define the notification, correspondence and escalation mechanisms and guarantee immediate notice to the company of violations and other events arising from any malfunction of the services, with the remediation taken or proposed; and include terms that let the Central Bank perform its supervisory duties and bind the provider to any requirement, circular or instruction the Central Bank issues in relation to the assigned services.