ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403)

Guideline 6: Access and audit rights – ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403)

ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403) 34: Keep the contract from limiting the firm's and the competent authority's access and audit rights

What does 34 require?

A firm makes sure nothing in the written agreement restricts it, or its competent authority, from effectively exercising their rights of access, audit and oversight over the CSP.

Maintained by Gerard Blokdyk

Other controls in Guideline 6: Access and audit rights – ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403)

35 Scale the exercise of access and audit rights to criticality and risk
36 Agree alternative assurance where an audit would put the provider's environment at risk
37 Use third-party certifications, audit reports and pooled audits to use audit resources efficiently
38 Assess the adequacy of certifications and reports for critical or important functions and avoid sole reliance
39 Rely on certifications and reports only when the scope, currency, auditor, standards and rights are satisfactory
40 Give the provider reasonable prior notice of on-site visits, except in emergencies
41 Staff audits and report reviews with people who have the skills for cloud services

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403) controls