FFIEC IT Examination Handbook OTS-05: Requirements Definition (Outsourcing Technology Services)

Management defines the business requirements that govern every subsequent outsourcing step, with all groups that will deal with the provider or use the service represented, requirements that support solicitation, selection, contracting and monitoring, and documentation that lets the delivered service be checked against expectations, producing a detailed document covering the scope and nature of the service, technology and customer support, standards and service levels for availability, performance, change management, financial reporting, quality, security and business continuity, and the minimum acceptable provider characteristics of industry and management experience, architecture, process controls, financial condition, reputation, reliance on third parties and compliance history.