Without prejudice to the EIOPA cloud-outsourcing guidelines, where ICT services/systems are outsourced undertakings ensure the relevant requirements are met; for outsourcing of critical or important functions, contractual obligations (contract, SLAs, termination) must include at least appropriate information security objectives/measures (incl. minimum security requirements, data lifecycle, audit/access rights, data-centre location, encryption, network security and monitoring), SLAs ensuring continuity and performance, and operational/security incident handling with escalation and reporting; and undertakings monitor and seek assurance on provider compliance.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.