ISLAMABAD: The Securities and Exchange Commission of Pakistan has updated its guidelines regarding security of data in which SECP directed Pakistani companies not to use cloud server providers based in India and Israel.
SECP said the cloud servers based in any hostile country can lead to breach of data of companies and their customers.
The Commission has issued a set of guidelines for companies operating in Pakistan. The Cloud Computing is a technological framework which provides a convenient, on demand access to a shared poll of resources such as servers, storage, and applications, through the internet.
SECP said the new guidelines will be applicable to all Business Entities (BEs) incorporated with Securities and Exchange Commission of Pakistan under the Companies Act 2017, Securities Act 2015, Insurance Ordinance 2000 and NBFC Regulations 2008 etc.
The new guidelines are effective from June 1, 2021; however, earlier adaptation is encouraged.
The SECP stated that several free cloud computing options exist for emails, document management and even CRM and ERP. BE just need to pay only its usage exceeds in number of user count or storage space. Some cloud services providers also offer the free trial periods to the users. The BE must review services before deciding to buy these services. Assess if the cyber security requirements, which are based on the Pakistan Cloud First Policy 2021, National Cybersecurity Policy 2021, sector specific guidelines, authentication requirements and other specific cyber security measures and regulations are met by the Cloud model under consideration.
A BE incorporated with SECP is an organization that would typically have many employees. These business owners are well aware of cloud computing. They have adopted cloud computing for its economies of scale, ease of use and low cost. Many BEs have been on the leading edge of public cloud advocacy and adoption. Cloud facilitate in reducing/eliminating capital expenditures (Capex), gives flexibility to launch or scale a business; however, it will be a business decision of the BEs based on control on their data and cost savings in the short vs long term.
The SECP said that there is a strong demand for cloud adoption by BEs for cloud-based server capacity, information and database management, security, system and user access management, ERP, CRM and collaboration tools. Throughout the adoption process, BEs need to focus on the areas of trust, security, legal, compliance and organizational issues.
While performing the planning in adoption of cloud in business, every individual in business have their different opinions. Overall, respondents willing to consider purchasing of cloud solutions and needs are recorded and considered to identify the actual requirement of cloud adoption in business.
