India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Pre-Migration Security and Compliance Gap Assessment for Cloud
A pre-migration security and compliance assessment compares the controls protecting workloads on-premises today with what the target cloud baseline and your regulators will require after the move, before any workload migrates. NTSPL maps each control to the shared responsibility model, flags gaps that would fail an RBI, SEBI, IRDAI or DPDP review, and designs the target controls into the landing zone.
Delivered on
In scope
Controls That Vanish When Workloads Move
On-premises, many controls are physical or implicit: a firewall nobody changes, an admin VLAN, logs kept on a SIEM appliance in the same room. Lift those workloads into cloud and the implicit controls disappear, while the regulator's expectations do not. Banks and NBFCs discover in their first post-migration inspection that log retention, privileged access or data location cannot be evidenced, and remediation then happens under an observation deadline.
NTSPL inventories current controls per workload tier, maps each to a target cloud control and to the provider's or customer's side of the shared responsibility model, then overlays the applicable regulations: RBI IT governance and outsourcing directions, SEBI CSCRF, IRDAI cyber security guidelines, CERT-In directions and the DPDP Act 2023. Gaps are rated by regulatory exposure and fed into the landing-zone design before wave one.
Who Needs a Control Gap Review Before Migrating
Signals you need Security & Compliance Assessment
- A bank, NBFC, broker, AMC or insurer plans to move regulated workloads and expects an inspection within 12 months
- Workloads processing personal data of more than 1 lakh customers are in the first two waves
- Current logs are retained on-premises for under 180 days or in a SIEM that will not follow the workload
- Privileged access today relies on network location rather than identity, with shared admin accounts
When to choose something else
- Workloads are already live in cloud and the concern is misconfiguration: that is a posture review of the existing estate with CSPM findings.
- Only non-regulated dev and test environments are moving: apply the provider's security baseline directly.
Control Domains We Map
Identity and privileged access
Admin accounts, MFA, PAM tooling and segregation of duties today, mapped to cloud IAM roles and just-in-time access.
Network and perimeter
Firewall rules, DMZ, WAF and segmentation translated into security groups, firewalls and private endpoints.
Logging and detection
Log sources, retention, time sync and SIEM coverage measured against CERT-In's 180-day retention and 6-hour reporting.
Data protection and location
Classification, encryption, key custody and residency for personal and regulated data under DPDP Act 2023 and sector rules.
Regulatory and contractual
Outsourcing approvals, audit rights, provider certifications and exit clauses required by RBI, SEBI or IRDAI.
Control-to-Cloud Mapping Pipeline
On-Premises Control to Cloud Baseline Mapping Pipeline
Current controls are inventoried per workload tier and mapped to target cloud controls and responsibility owners. A regulatory overlay rates gaps, which flow into the landing-zone and workload designs as mandatory requirements.
Select any component
On-Premises Control to Cloud Baseline Mapping Pipeline: click any of its 7 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Compliance Evidence Tools Across the Three Clouds
Provider reports come from AWS Artifact, and target controls are expressed as Config conformance packs so Security Hub CSPM and Config can report evidence once workloads land in Mumbai.
Target controls are mapped to Azure Policy initiatives so Defender for Cloud's regulatory compliance dashboard reports against them from the first subscription.
Provider certifications come from Compliance Reports Manager; data-location and perimeter requirements become organisation policies and VPC Service Controls perimeters.
Control Design Choices for Regulated Workloads
Where logs live and for how long
Send security logs to a central, separate logging account or project in an Indian region, with at least 180 days hot and longer archival where sector rules ask. Make the log store write-once for administrators of workload accounts. Synchronise time to NTP sources acceptable under CERT-In directions so incident timelines stand up in a 6-hour report.
Key custody for regulated data
Provider-managed keys are acceptable for most workloads. Use customer-managed keys with separate key administrators for core lending, payments and policyholder data, and consider HSM-backed keys where an inspector expects demonstrable key control. Avoid external key management unless a specific mandate requires it; it adds availability risk.
Translating firewall rules
Do not migrate 2,000-line firewall rule sets one to one. Group rules by application flow from discovery, rebuild them as least-privilege security groups or firewall policies, and drop rules with zero hits in 90 days. Typically 40-60 percent of legacy rules disappear, which shrinks the audit surface.
Privileged access model
Replace network-location trust with identity: MFA on every privileged role, just-in-time elevation with approval for production, and no standing owner rights. Keep two tested break-glass accounts per tenancy with alerts on use. Shared admin accounts should be eliminated before migration, not after.
Five-Week Control Gap Review
Evidence collection
Firewall exports, privileged group lists, SIEM sources, policies and contracts gathered.
Data location sampling
Personal and regulated data located in sampled databases and file shares.
Control mapping
Each control mapped to the target baseline and shared responsibility owner.
Regulatory overlay and rating
Applicable clauses linked and gaps rated with the compliance head.
Control backlog
Mandatory controls written into landing-zone requirements and presented to the risk committee.
What you receive
Measures of Compliance Readiness
| KPI | Typical target |
|---|---|
| Regulatory clauses mapped to controls | 100 percent of applicable clauses |
| High-severity gaps closed before wave one | 100 percent |
| Firewall rules carried into cloud | Typically 40-60 percent of legacy count |
| Inspection observations on migrated workloads | Zero high-severity |
Gaps That Surface Too Late
| Risk | How NTSPL prevents it |
|---|---|
| Questionnaire answers mistaken for evidence | Every current control is backed by an export, screenshot or policy document. |
| Personal data found in unexpected places | Sampling of databases and shares, not labels alone, before waves are fixed. |
| Provider certifications assumed to cover customer controls | The shared responsibility matrix names who evidences each control. |
Pre-migration security assessment or cloud security posture review: which do we need?
If workloads have not moved yet, you need the pre-migration assessment. It looks at today's on-premises controls and regulators' expectations, and designs what must exist in the target before anything lands, so the landing zone is built compliant. A posture review examines live cloud accounts, subscriptions or projects for misconfiguration, exposed resources and IAM sprawl, usually with CSPM tooling. Organisations already partly in cloud often need both: posture review for what is live, pre-migration assessment for the next waves. Running only a posture review after migrating regulated workloads tends to find gaps once they are already inspection findings.
Key facts: Security & Compliance Assessment
Security & Compliance Assessment in Practice
2 Security & Compliance Assessment scenarios, from Banking (regional private sector bank) and NBFC (gold loans), plus related platform case studies.
Regional private bank designs RBI-ready controls before moving digital channels
Gold-loan NBFC finds Aadhaar-linked data in 9 unexpected tables before AWS migration
Health-tech SaaS moves patient data behind KMS and Identity Center ahead of DPDP
Three directories become one: identity consolidation after two acquisitions
Security & Compliance Assessment: Frequently Asked Questions
How long does a pre-migration security and compliance assessment take?
Five weeks for most regulated mid-sized organisations. Evidence collection takes two weeks and depends on how quickly firewall, identity and SIEM owners respond; mapping and rating take the remaining three. Where several regulated entities share infrastructure, each entity's obligations are mapped separately.
What does the assessment cost?
Typically 18-28 consultant days, driven by the number of regulators involved and workload tiers. A single-regulator NBFC sits at the lower end; a group with banking and insurance entities at the upper end. Provider attestations from official compliance portals are collected at no extra cost.
Which Indian regulations are covered?
RBI's IT governance and IT outsourcing master directions, SEBI's Cybersecurity and Cyber Resilience Framework, IRDAI's information and cyber security guidelines, CERT-In's 2022 directions and the DPDP Act 2023, applied according to your licence category. Each applicable clause is linked to a named target control and the evidence an inspector would request.
Does migrating to cloud reduce our compliance burden?
Partly. Provider certifications cover physical and infrastructure controls, but identity, configuration, data protection, logging and outsourcing governance remain yours. The shared responsibility matrix shows exactly which evidence you still produce. Regulated entities also remain accountable for outsourced services under their regulators' directions.
Will the assessment tell us which cloud is most compliant?
All three major providers offer Indian regions and broad certifications. The assessment shows which target controls are easier to evidence on each, which can inform placement, but rarely decides it alone. In practice, residency of regulated data in Indian regions is the deciding constraint more often than certifications.
What happens to the gap register after migration?
It becomes the control baseline for posture monitoring. Each mandatory control is written as a policy that can be checked continuously once workloads are live. Posture tooling can then report against the same controls the regulator will test.