Qatar Central Bank Cloud Computing Regulation (2024) 9: Keep a complete register of cloud arrangements with the prescribed fields, disclose it to QCB annually and cover intermediaries and primary sub-contractors

What does 9 require?

An entity develops and keeps current a register that inventories every cloud computing arrangement, distinguishing material arrangements from others, discloses to QCB the criteria it uses to decide materiality, and discloses the full register to QCB annually and on request. For each arrangement the register records whether a background check and a risk assessment were performed on the CSP; the start date, next renewal date, end date and notice periods for both parties; a description of the outsourced activities and data; the classification of data processed or stored and whether it is PII or transactional data; an entity-assigned category reflecting the nature of the function and whether it supports time-critical operations; the CSP's name and brand; any intermediary used to reach the CSP; the CSP's country of registration, local registration number and LEI where available, registered address and contact details, parent company where applicable; and the governing law and any choice of jurisdiction. The same items are recorded for a vendor's CSP where data is processed there and for each of the CSP's primary sub-contractors.