Cloud Compliance

Cloud compliance means implementing the legal, contractual and internal requirements applicable to a cloud deployment and retaining evidence that they are met. Cloud security protects data and systems; governance assigns responsibilities and decisions. Technical security alone therefore does not cover every compliance obligation.

For banks, the entity type, supported business function, data and service providers matter. Financial entities subject to DORA remain responsible for their obligations when using external ICT services. A provider's attestation does not replace the customer's risk assessment, secure configuration, contracts or ongoing oversight. ADVISORI combines this assessment with cloud governance and technical controls, with a focus on EU and German financial-sector requirements.

First determine which rules apply to the institution and the specific cloud service. For entities within DORA's scope, DORA governs ICT risk management and ICT third-party risks. BAIT do not apply additionally to institutions required to operate ICT risk management under the relevant DORA provisions; transitional requirements can still matter for other institutions in 2026.

Assess risk, contracts and controls, data processing, outsourcing classification and supervisory responsibilities. The DORA register of information covers contractual arrangements for ICT services; maintenance, coverage and current submission instructions require separate attention. A blanket statement that this obligation first began in March 2026 is inaccurate.

Source: Bundesbank: BAIT / DORA.

ADVISORI supports ICT risk management, cloud governance, provider assessment, the register of information and coordinated control and incident-reporting processes. Scope depends on the institution, cloud services and supported functions.

DORA distinguishes general ICT contract requirements from additional requirements for services supporting critical or important functions. Relevant topics include service scope, subcontracting, processing locations, control rights, incident assistance and exit provisions. A SaaS contract should therefore not be approved solely on the basis of a provider logo or certificate.

Illustrative example, not a customer case: For cloud document storage, record who operates the platform, who approves users and roles, and who reviews changes. Evidence can include applicable provider reports, customer configuration records and documented access reviews. Link each item to a service, date and responsible owner. TLPT is a separate testing scope for designated financial entities, not an automatic part of every cloud consulting engagement.

Legal source: DORA, particularly Articles 28–30.

C5 is a BSI catalogue of information-security criteria for cloud services. An attestation follows an independent examination; it is not a certificate issued by BSI. Review the service and scope, catalogue version, assessment period, exceptions and controls the customer must operate.

Type 1 and Type 2 differ in their point-in-time assessment and examination of operating effectiveness over a period. This does not establish a universal requirement for every financial institution to obtain a particular type or meet a fixed minimum duration. Evidence needs depend on the deployment and applicable requirements; the customer's risk assessment remains necessary. ADVISORI supports report evaluation, gap assessment and examination preparation.

Source: BSI: C5 criteria catalogue.

The EBA outsourcing guidelines (EBA/GL/2019/02) provide a reference for outsourcing governance, risk analysis, contracts, monitoring and exit planning. For cloud services, assess their relationship with DORA and the national requirements applying to the institution. Not every ICT service is also an outsourcing arrangement, so DORA ICT third-party obligations must not depend solely on an existing outsourcing classification.

Distinguish the institution, service, supported function and applicable framework in the assessment. A consultation on revised guidelines is not an applicable final version. ADVISORI supports this mapping and consistent processes without unnecessarily duplicating the same evidence.

Multi-cloud governance combines common policies with each service's technical features. ADVISORI supports central policies, monitoring, infrastructure-as-code controls and provider assessment. Translate common requirements into controls actually available across AWS, Azure, Google Cloud and SaaS services.

For each control, record the requirement, service, owner, test method, evidence and outstanding exception. Automated checks can detect public sharing or missing logging; contractual rights, lawful processing and organisational approvals need further assessment. A green dashboard proves only the tested criteria within its coverage.

Map storage and processing locations, support access and subcontractors. An EU data centre alone does not settle every privacy or international-transfer question. Multi-cloud is not an automatic compliance guarantee and can introduce additional dependencies.

The existing roadmap covers inventory and gap assessment, governance and responsibilities, technical controls, provider management and ongoing monitoring. Record the starting point, agreed outputs, owners and unresolved decisions for each stage.

For ICT services supporting critical or important functions, exit planning forms part of the DORA assessment. In practice, examine data export, usable formats, restoration, access changes and a realistic transition. A written plan alone does not show that a switch will work: record suitable tests and their limitations.

For an initial inquiry, describe the institution, cloud providers and services, business functions, data categories, existing contracts and available examination reports. Effort depends on service count and complexity, evidence gaps, contractual and integration work, and testing scope. Delivery scope and costs are agreed accordingly; sensitive original data is not needed for the first inquiry.