This exposure draft sets out the proposed guidance to assess common key risks and considerations of control measures when financial institutions adopt cloud services. The proposed guideline complements the Risk Management in Technology (RMiT) policy document to strengthen financial institutions’ cloud risk management capabilities.

Exposure Draft on Cloud Technology Risk Assessment Guideline (CTRAG)

Submission of feedback

Bank Negara Malaysia invites written feedback on the proposals in this exposure draft, including suggestions on areas to be clarified or elaborated further and alternative proposals that the Bank should consider. The written feedback should be supported with clear rationale, accompanying evidence or illustrations as appropriate to facilitate the Bank’s assessment.

Feedback should be submitted to the Bank by email to [email protected] by 15 July 2022.

Applicability

1. Licensed banks
2. Licensed investment banks
3. Licensed Islamic banks
4. Licensed insurers including professional reinsurers
5. Licensed takaful operators including professional retakaful operators
6. Prescribed development financial institutions
7. Approved issuer of electronic money
8. Operator of a designated payment system

Issuing department
Risk Specialist and Technology Supervision