The European Central Bank (ECB) has finalised its Guide on outsourcing cloud services. Its objective is to ensure more consistent supervision and to ensure a level playing field for all supervised banks. The Guide sets out supervisory expectations for implementing the Digital Operational Resilience Act (DORA) and makes recommendations on how outsourcing risks – especially in the IT and cybersecurity areas can be controlled effectively.
The Guide does not lay down legally binding requirements, but distinguishes clearly between legal requirements and recommended best practices. The Guide was revised and finalised following a public consultation, especially with regard to the risk-based approach and the application of the principle of proportionality.
The full Guide and responses to the consultation can be found on the ECB Website.