Which standards require an outsourcing policy?

ISO/IEC 27001:2022: 8.30; DORA (Regulation (EU) 2022/2554): Art. 28.

Who should own the outsourcing policy?

The clauses imply procurement or the vendor manager, with the information security lead. The register names the role so the line on your list can carry a name.

How often should an outsourcing policy be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for an outsourcing policy?

Yes: https://compliance.theartofservice.com/policy-templates/outsourcing-policy

Every policy type · Suppliers and third parties

Outsourcing policy

Q: What must an outsourcing policy contain under ISO 27001?

8.30: Direct, monitor and review outsourced system development. The ISO 27002 guidance beside 8.30: Requires the organisation to direct, monitor and review the activities involved in outsourced system development. Secondary commentary notes that explicit direction and review were added in the 2022 revision in response to third party risk.

The conditions for handing a function or a development to an external party: the approval, the oversight, the access and the return.

How the register reads it

Also called	outsourced development, managed services policy
Family	Suppliers and third parties
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the supplier and third-party security policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	Procurement or the vendor manager, with the information security lead.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, supplier and third-party security policy, is).
Template	Outsourcing policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.30 Outsourced development

Direct, monitor and review outsourced system development.

What the ISO 27002 guidance expects the document to say: Requires the organisation to direct, monitor and review the activities involved in outsourced system development. Secondary commentary notes that explicit direction and review were added in the 2022 revision in response to third party risk.

Evidence an auditor accepts: Contractual security requirements imposed on the development supplier, covering secure development practice, testing, code ownership and the right to review; evidence of direction given, such as agreed standards, architecture constraints and acceptance criteria; evidence of monitoring during delivery, including progress and security reviews rather than acceptance testing alone
Common gap: contracts lack specific security obligations
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

DORA (Regulation (EU) 2022/2554)

DORA Art. 28 ICT third-party risk: general principles

Financial entities shall manage ICT third-party risk as an integral component of ICT risk, maintain a Register of Information on all contractual arrangements for the use of ICT services, report it to competent authorities, assess risk before entering arrangements (including concentration and subcontracting), and adopt an ICT third-party risk strategy.

Evidence an auditor accepts: A Register of Information of ICT third-party arrangements reported to the competent authority; pre-contract risk assessment records
Common gap: No Register of Information
Source: DORA (Regulation (EU) 2022/2554)

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Cloud vendor management policy · Service level management policy