Framework for Adoption of Cloud Services by SEBI Regulated Entities (REs)
Summary
This circular establishes a framework for the adoption of cloud services by SEBI regulated entities to address cyber security risks and regulatory compliance. It defines the scope of applicability to various financial intermediaries including stock exchanges, depositories, and mutual funds. The document outlines immediate applicability for new projects and a twelve-month transition period for existing cloud arrangements. This section mandates specific milestone-based reporting timelines for regulated entities currently using cloud services, including initial details, a roadmap, and quarterly progress reports. It defines the scope of the framework by clarifying its applicability to public, community, and hybrid cloud models while excluding private clouds from this specific document. The text further prohibits the deployment of any cloud models not explicitly permitted under the framework. This part outlines the principle-based framework for cloud adoption, listing nine core principles including governance, risk, compliance, and data localization. It establishes that SEBI Regulated Entities (REs) are solely accountable for all aspects of cloud services adopted, regardless of outsourc
Text
The framework is drafted to provide baseline standards of security and for the legal and regulatory compliances by the RE, acknowledging that cloud computing introduces new cyber security risks and challenges.
The major purpose of this framework is to highlight the key risks, and mandatory control measures which REs need to put in place before adopting cloud computing.
The framework shall be applicable to Stock Exchanges, Clearing Corporations, Depositories, Stock Brokers through Exchanges, Depository Participants through Depositories, Asset Management Companies/Mutual Funds, Qualified Registrars to an Issue and Share Transfer Agents, and KYC Registration Agencies.
The framework shall come into force with immediate effect for all new or proposed cloud onboarding assignments/projects of the REs.
REs which are currently availing cloud services shall ensure that, wherever applicable, all such arrangements are revised and they shall be in compliance with this framework not later than 12 (twelve) months from the date of issuance of the framework.
REs shall provide details of the cloud services, if any, currently deployed by them within one (1) month of issuance of framework.
The REs shall submit a roadmap (including details of major activities, timelines, etc.) for the implementation of the framework within three (3) months of issuance of framework.
Quarterly progress report as per the roadmap submitted by the RE shall be provided from three (3) to twelve (12) months of issuance of framework.
Compliance with respect to the framework to be reported regularly after twelve (12) months of issuance of framework.
The above-mentioned reporting shall be done to the authority as per the existing mechanism of reporting for systems audit/cybersecurity audit.
This cloud framework is applicable for adoption of public cloud and community cloud. Consequently, REs are permitted to deploy public cloud and community cloud models, subject to the conditions specified herein.
Private cloud deployments shall be governed by SEBI circulars... Therefore, private cloud deployments (by REs) are permitted, however, such deployments may not be governed by this cloud framework.
You have read the preview. Create a free account to read the full document and see every order that applied it.
Free accounts include 10 searches/day with full text access.
Source: SecMarx — Framework for Adoption of Cloud Services by SEBI Regulated Entities (REs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.