Bank of Mauritius Guideline on Use of Cloud Services (2022)
The Bank of Mauritius guideline on use of cloud services: governance, risk and materiality assessment, prior notification of material services, provider due diligence, contract terms, cloud security management, review and audit, data location, contingency and exit, subcontracting, the cloud register, returns and incident reporting.
Bank of Mauritius Guideline on Use of Cloud Services (2022) is a compliance framework from Mauritius with 10 domains and 41 controls. The largest domains are Section 7: Cloud security management – Bank of Mauritius Guideline on Use of Cloud Services (2022) (11 controls), Section 1: Governance framework – Bank of Mauritius Guideline on Use of Cloud Services (2022) (6 controls), Section 8: Review, audit, testing and control functions – Bank of Mauritius Guideline on Use of Cloud Services (2022) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (10)
Section 10: Contingency plans and exit strategies – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::10.1.i | Set, agree and test business continuity requirements for material services |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::10.1.v | Keep documented and regularly reviewed exit strategies with the minimum content |
Section 1: Governance framework – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::1.1 | Hold a board-approved cloud strategy |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::1.2 | Maintain a risk-based, board-approved policy for the use of cloud services |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::1.3 | Board retains ultimate responsibility and discharges the named oversight duties |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::1.3.2.xi | Receive a comprehensive report before approving any material cloud service |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::1.4 | Branches and subsidiaries of foreign banks adopt group strategy and policy only where they meet the guideline |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::1.5 | Senior management oversees design, implementation and ongoing performance of cloud services |
Section 4: Regulatory notification – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::4.1 | Notify the Bank at least 60 days before deploying a material cloud service, with a CEO attestation |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::4.3 | Include outsourcing and subcontracting details in the notification and notify material subcontracting changes |
Section 5: Due diligence on the cloud service provider – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::5.1 | Conduct proportionate due diligence on the provider before use |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::5.3 | For material services, cover the named due diligence elements and document and approve the result |
Section 6: Contractual obligations – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::6.1 | Use a written agreement that secures access to cloud-held information for the institution and the Bank |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::6.2 | Agreements for material and customer-information services protect supervision, data protection and confidentiality |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::6.3.i | Agreements for material services grant audit, access and cooperation rights to the Bank, the institution and their auditors |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::6.3.iii | Agreements for material services cover exit, record keeping, notice of changes, the Bank's step-in, termination, deletion, incidents and governing law |
Section 7: Cloud security management – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.1 | Determine security controls in line with risk appetite and the characteristics of the service |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.i | Know the provider's security measures, assess vulnerabilities regularly and keep cloud controls at least as strong as on premise |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.iv | Obtain assurance over the hypervisor and safeguard against virtualisation risks |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.vi | Keep an inventory of IT assets on the cloud and apply proportionate identity, access and network controls |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.viii | Encrypt data at rest and in transit and manage encryption keys under institution control |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.xi | Segregate, protect and identify the institution's data |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.xii | Secure containers, microservices and APIs |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.xv | Operate an incident management process and centralised visibility over core cloud components |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.xvii | Encrypt point-to-point connectivity, use dual connectivity from Mauritius and keep logs and audit trails |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.xx | Mitigate concentration risk by provider and by geography |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::7.2.xxi | Apply the enhanced controls required for public cloud |
Section 8: Review, audit, testing and control functions – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::8.1 | Set risk-based review, testing and audit frequency, at most 18 months for material services |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::8.3 | Review material and customer-information services end to end |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::8.4 | Rely on third-party reports and pooled audits only with the named safeguards |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::8.6 | Resource the control functions and have them and the external auditors review cloud services periodically |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::8.8 | Assess vulnerabilities before deploying a material service and penetration test immediately after |
Section 9: Data location – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::9.1 | Know where data is hosted and satisfy the data location conditions |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::9.2 | Have the data location assessment done by a competent officer or reputable firm |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::9.3 | Agree the list of processing locations and control any processing outside it |
Sections 11 and 12: Subcontracting, record-keeping and reporting – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::11.1 | Know, assess and control subcontracting of material services |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::12.1 | Keep an updated register of all cloud services |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::12.2 | Submit the Return on Use of Cloud Services to the Bank |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::12.3 | Report cloud incidents to the Bank promptly |
Sections 2 and 3: Risk assessment and materiality assessment – Bank of Mauritius Guideline on Use of Cloud Services (2022)
| Code | Title |
|---|---|
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::2.1 | Document a risk assessment covering the named elements |
| bank-of-mauritius-guideline-on-use-of-cloud-services-2022::3.1 | Assess materiality against the minimum factors |
What is Bank of Mauritius Guideline on Use of Cloud Services (2022) and who does it apply to?
Bank of Mauritius Guideline on Use of Cloud Services (2022) is a compliance framework from Mauritius with 10 domains and 41 controls. The Bank of Mauritius guideline on use of cloud services: governance, risk and materiality assessment, prior notification of material services, provider due diligence, contract terms, cloud security management, review and audit, data location, contingency and exit, subcontracting, the cloud register, returns and incident reporting. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Bank of Mauritius Guideline on Use of Cloud Services (2022) actually require?
Bank of Mauritius Guideline on Use of Cloud Services (2022) has 41 controls organised across 10 domains. The largest domains are Section 7: Cloud security management – Bank of Mauritius Guideline on Use of Cloud Services (2022) (11 controls), Section 1: Governance framework – Bank of Mauritius Guideline on Use of Cloud Services (2022) (6 controls), Section 8: Review, audit, testing and control functions – Bank of Mauritius Guideline on Use of Cloud Services (2022) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Bank of Mauritius Guideline on Use of Cloud Services (2022) do I already cover?
Bank of Mauritius Guideline on Use of Cloud Services (2022) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Bank of Mauritius Guideline on Use of Cloud Services (2022)?
Start your Bank of Mauritius Guideline on Use of Cloud Services (2022) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Bank of Mauritius Guideline on Use of Cloud Services (2022) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 41 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required