Four markets
The continuity rules a cloud customer is already held to
The draft guidance will not arrive into an empty room. Each market already has continuity, resilience or outsourcing rules that decide what a customer must evidence, and those rules are why the preparation work is worth starting before publication. The frameworks below were chosen by scanning the held rules in market order, not from a fixed list.
The baseline that runs through all four
ISO 22301:2019, 57 cited clauses. It is the continuity management system the customer runs, and the system the cloud guidance builds on. Every market view below is a local overlay on that baseline, not a replacement for it.
United States
| Framework | Cited clauses | Why it matters here |
|---|---|---|
| NFPA 1600 | 220 | The continuity, emergency and crisis management standard most often used by United States organisations; it supplies the programme structure a cloud customer is expected to already run. |
| ASIS SPC.1-2009 | 77 | An organisational resilience standard adopted under the United States PS-Prep programme; useful where the board wants a resilience view that is wider than continuity alone. |
Federal sector regulators add their own outsourcing rules. Where a regime is not held here it is named, not stated.
European Union
| Framework | Cited clauses | Why it matters here |
|---|---|---|
| EIOPA Guidelines on Outsourcing to Cloud Service Providers (EIOPA-BoS-20-002) | 16 | The clearest European statement of what a regulated customer must do before and during cloud outsourcing, including exit and audit rights. |
| EU Cyber Resilience Act | 226 | Sets the product security and vulnerability duties that shape what a cloud provider will be able to promise a customer. |
The Digital Operational Resilience Act is named here as an obligation for financial entities. Its text is not held, so no requirement from it is stated.
United Kingdom
| Framework | Cited clauses | Why it matters here |
|---|---|---|
| UK FCA/PRA Operational Resilience Framework | 32 | Requires important business services to be mapped through their dependencies, which is exactly where cloud providers sit. |
| BS 65000:2014 - Guidance on Organizational Resilience | 32 | A United Kingdom guide to resilience as a management outcome, used where the continuity system needs a wider frame than recovery. |
No regulator is named as endorsing this product. The frameworks are the held references the buyer's own regime is built on.
Australia
| Framework | Cited clauses | Why it matters here |
|---|---|---|
| ASIC Cyber Resilience Good Practices | 29 | The Australian regulator's published good practice for resilience, including third party and cloud dependency. |
APRA's prudential standard on operational risk is named as the obligation for prudentially regulated entities. Its text is not held, so no requirement from it is stated.
How the choice was made
For each market in order, the held rules were scanned for continuity, resilience, outsourcing and business continuity, and the frameworks that genuinely apply to a cloud service customer were selected. A federal or primary regime came before a narrower one. Where a regime that matters is not held, it is named and no requirement from it is stated. The scan, the choice and the counts are recorded in the build record.
The rules this is built from
Every requirement on this site is written from a held rule and points to the clause it came from. Nothing is invented while you wait.
- Read from the real rules, not invented
- 57 official requirements behind it
- Cross-checked against 7 continuity and resilience frameworks
- Check any line yourself
How the record is made and where each source comes from. The continuity baseline is ISO 22301:2019, read here.