Before digital operational resilience1 was in full focus in of the European Supervisory Authorities (including the European Securities and Markets Authority – ESMA) and national competent authorities (NCAs) cloud outsourcing was a primary area of rulemaking and supervisory guidance. On December 18, 2020, ESMA released2 its final Cloud Outsourcing Guidelines (the COGs).3 The responses to the public consultation on the COGs also set further details on ESMA’s supervisory expectations.