T/CCUA 003-2023 Active

Scope: This document establishes a maturity model for risk management of IT outsourcing in the financial industry, specifies the general requirements for assessing the maturity of contractors' and clients' capabilities, and provides a method for evaluating the maturity of outsourcing risk management capabilities of both parties. This document is applicable to the assessment of outsourcing risk management capabilities of the main actors (including clients and contractors) in IT outsourcing activities in the financial industry. Main technical content: 1. Client Capability Model: The client's capability is divided into three aspects of outsourcing management, namely normative management, risk control, and effectiveness control, which constitute three capability domains. The normative capability domain (D1) includes four capability items: organization (D1/P1), system (D1/P2), process (D1/P3), and system (D1/P4); the risk control capability domain (D2) includes four capability items: network security and data security (D2/P1), continuity (D2/P2), property rights (D2/P3), and compliance (D2/P4); the effectiveness control capability domain (D3) includes three capability items: cost (D3/P1), quality (D3/P2), and efficiency (D3/P3), totaling 11 capability items. Each capability item is divided into 1-5 maturity levels: starting level (Level 1), developing level (Level 2), stable level (Level 3), excellent level (Level 4), and excellent level (Level 5). 2. Contractor Capability Model: The contractor's capability is divided into three aspects of professional technical capability, service delivery capability, and enterprise operation capability, which constitute three capability domains. The professional technical capability domain (D4) includes three capability items: technical qualifications (D4/P1), software copyright/patent (D4/P2), and talent structure (D4/P3); the service delivery capability domain (D5) includes four capability items: service system (service capability,