The recommendations cover the entire outsourcing process and build in higher standards in case critical or important functions and activities are outsourced. They reflect the opportunities that outsourcing can offer, but equally recognise the risks inherent thereto, especially in respect to cloud outsourcing. Successful (cloud) outsourcing strategies in the insurance sector will therefore require an integrated and pro-active approach.

In summary, the NBB recommends insurers to:

  1. Ask themselves whether or not the contemplated arrangement constitutes outsourcing;
  2. Ensure that any decision to outsource critical or important functions/activities is based on a through risk assessment;
  3. Update the written outsourcing policy;
  4. Carry out a pre-outsourcing analysis;
  5. Assess whether it concerns a critical or important function/activity;
  6. Identify and assess the potential impact of cloud outsourcing in order to adopt an proportionate risk approach;
  7. Perform a due diligence on the cloud service provider;
  8. Clearly allocate the rights and obligations of the company resp. cloud service provider;
  9. Preserve access and audit rights in order to comply with their regulatory obligations;
  10. Ensure regulatory compliance (incl. ICT security standards) by cloud service providers;
  11. Consider and insert arrangements on sub-outsourcing (if permitted);
  12. Monitor the cloud outsourcing arrangements and set up the necessary mechanisms to do so;
  13. Have a clearly defined exit strategy clause to terminate the agreement (if necessary);
  14. In case the cloud service provider’s data are located outside the EEA, ensure (and enforce) access and audit rights;
  15. Retain original copies of certain documents at the registered office.