This requirement reduces risk in cloud data protection by ensuring data compliance is defined, consistently implemented and demonstrably effective across cloud environments. It supports the organization's need to secure cloud-based assets, data and services while managing cloud-specific risk.
Map cloud data processing and storage to applicable legal, regulatory, contractual and internal requirements. Maintain evidence of control operation and remediation of gaps.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.19-3.3 – Compliance |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 1) Inventory Management of Business IT Assets – 1.3 Protection of data/information across storage, transmission, processing and access, inside/outside the bank; 15) Data Leak prevention strategy – 15.2 Protection of data at endpoints, in transmission and stored online/offline |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security Article 9(3) – ICT solutions/processes for secure data transfer and prevention of loss, unauthorised access and data compromise Article 30(2)(c) – Availability, authenticity, integrity, security and protection of personal data |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.20 – Addressing information security within supplier agreements; 5.23 – Information security for use of cloud services |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(a) – Policies on risk analysis and information system security |
EU
Directive
|
vCurrent | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 3.5.1 – PAN is rendered unreadable anywhere it is stored; 4.2.1 – Strong cryptography and security protocols |
PCI
Standard
|
v4 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied PR.IR – Technology Infrastructure Resilience | PR.IR-01 – Networks and environments are protected from unauthorized logical access and usage DE.CM – Continuous Monitoring | DE.CM-06 – External service provider activities and services are monitored to find potentially adverse events |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.18 – SYSTEM AND COMMUNICATIONS PROTECTION; SC-28 – PROTECTION OF INFORMATION AT REST |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: C1.1 – Confidentiality – The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality. CC6.1 – Logical and Physical Access Controls – The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives. |
AICPA
Audit Framework
|
vLatest | View → |