FSC Mauritius Guidelines on Cloud Computing Services (2023) 10.2: Senior management provides effective oversight of cloud deployment and reports incidents

What does 10.2 require?

Senior management oversees the deployment of cloud services in practice and makes sure providers are selected on the licensee's needs after due diligence, risk and materiality assessments; the board-approved policy and strategy are documented; the design of the arrangements, the security architecture in the cloud, the risk framework and the other internal controls and procedures follow sound governance and risk management; responsibility and accountability between licensee and provider are clearly delineated and the provider's responsibilities are scrutinised for compliance; the cloud security and data protection arrangements, on premise and in the cloud, are evaluated independently on a regular basis in line with section 9; and performance is monitored continuously, with incidents, including unauthorised access or a breach of confidentiality or security caused directly or indirectly by a provider, identified, escalated and reported promptly to the board and, for material incidents, to the FSC on the Schedule template.