Registered intermediaries?including POPs, Trusts, and CRAs?must treat cloud usage as outsourcing. They need a formal cloud policy, implement secure architectures, ensure data encryption, comply with PFRDA IT norms, and follow due diligence and monitoring over service providers.
