PRA SS2/21

Chapter 1 introduces the statement and its links to the PRA’s operational resilience framework. Chapter 2 explains proportionality. Chapter 3 sets out definitions and scope, including the distinction between outsourcing and other third party arrangements, and how materiality is assessed.

Chapter 4 covers governance and record-keeping, including board responsibilities, the outsourcing policy, Senior Manager accountability and the outsourcing register. Chapter 5 covers the pre-outsourcing phase: materiality and risk assessment, due diligence and notification to the PRA.

Chapter 6 sets out expectations for outsourcing agreements. Chapter 7 addresses data security, including data location. Chapter 8 covers access, audit and information rights. Chapter 9 addresses sub-outsourcing. Chapter 10 covers business continuity and exit plans.

The PRA Rulebook defines material outsourcing as outsourcing services of such importance that weakness, or failure, of the services would cast serious doubt upon the firm’s continuing satisfaction of the threshold conditions or compliance with the Fundamental Rules. SS2/21 also asks firms to consider whether an arrangement supports an important business service when assessing materiality.

Firms should assess materiality before entering an arrangement and reassess it periodically and when the arrangement changes. The same approach should be applied, proportionately, to non-outsourcing third party arrangements that support important business services.

SS2/21 does not prohibit or discourage cloud. It expects firms to take a risk-based approach to data location, understand where data is stored and processed, and consider the legal and political environment of those locations.

Firms are expected to define data security requirements, classify data, and understand how responsibility for security controls is shared with the cloud provider.

For material outsourcing, firms should have business continuity plans that cover the failure of the provider, and exit plans that are documented, sufficiently detailed and, where appropriate, tested.

Exit plans should cover both stressed and non-stressed scenarios, identify alternative providers or the option to bring the service back in house, and estimate the time and resources needed to exit without undue disruption.