FSC Mauritius Guidelines on Cloud Computing Services (2023) 10.1: Board keeps its responsibilities and discharges the named duties

What does 10.1 require?

The board of directors is not relieved of its responsibilities by delegating or outsourcing to a cloud provider. It approves the cloud strategy and policy; makes sure the policy is aligned with the strategy, the deployment model and the licensee's risk appetite; makes sure the cloud risk framework and adequate controls and security arrangements exist both on premise and in the cloud; approves the materiality criteria, the material cloud services and, as appropriate, the contingency strategy and exit plans; makes sure contingency plans and exit strategies are deployed effectively when a critical issue, unforeseen event or incident arises; makes sure cloud implementation respects the record keeping obligations of section 29 of the Financial Services Act, including a current register, paper or electronic, of information on the services; makes sure the licensee has the resources and capabilities to use the services and trains the relevant staff for effective oversight; and makes sure it and the audit committee get a comprehensive periodic report on cloud use.