Bank Cloud Platforms to Face Uniform Reliability and Security Tests

What the draft requires

Among the mandatory criteria is hosting the platform in a data center rated Tier III or higher under the Uptime Institute classification, which allows planned equipment maintenance without shutting the facility down. The cloud resource management system must be available at least 99.95% of the time. Backup and virtual machine recovery must also be verified.

Testing will also check whether the platform has an attested environment meeting FSTEC Order No. 239, which covers the security of significant critical information infrastructure objects. Public trials are planned for the fourth quarter of 2026.

Having two independent data centers is proposed as an optional criterion, and testing cloud operation under a full outage of one site remains only a recommendation.

Industry reaction

Nikolay Kozak, deputy chairman of the management board at Dom.RF bank, said critical banking systems already have separate requirements. A full shutdown of one of two sites is a catastrophic-failure scenario, he noted, and banks do not plan to move their entire infrastructure to the cloud, only less critical services or capacity.

K2 director Sergey Zinkevich said uniform criteria are being proposed for the first time. Audits in the infrastructure sector usually give providers specific findings and a chance to fix them, he said, though the exact procedure depends on the working group.

Ilya Vasilchenko of Turbo Cloud said power supply could be a serious problem for sites with weak engineering protection, and the tests should show whether a platform stays available when failures such as the loss of one power feed are simulated. A cloud provider source said the requirements are achievable through data center design, with multiple power lines, uninterruptible power supplies and backup diesel generators.