# SEBI Cloud Framework: SEBI framework for adoption of cloud services by regulated entities

> Governance, data localisation, security, audit and exit requirements for SEBI-regulated entities using cloud.

URL: https://securei3.com/standards/sebi-cloud-framework/
Category: India regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


SEBI’s framework for adoption of cloud services sets principles for regulated entities using cloud: governance and risk assessment, data ownership and localisation, security controls, legal and regulatory obligations, vendor due diligence, business continuity and exit, and audit of cloud service providers.

We assess your cloud deployments and contracts, design the controls and documentation SEBI expects, and align them with ISO 27017 and CSCRF.

## Who it is for

- SEBI-regulated entities moving workloads to cloud
- Cloud and SaaS providers serving capital markets

## Benefits

- Cloud adoption without regulatory surprises
- Contracts and exit plans that meet SEBI principles

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Are cloud providers required to be empanelled?

The framework expects regulated entities to use cloud service providers empanelled by MeitY and to meet the other conditions it sets. We help you verify and document this.

Related: https://securei3.com/standards/sebi-cscrf/, https://securei3.com/standards/iso-27017/, https://securei3.com/standards/rbi-it-outsourcing/

Contact: https://securei3.com/contact/: info@securei3.com