Surge Migrate

Guide · updated

AEM migration for banks and insurers: compliance and freeze windows

For a bank or insurer, moving AEM 6.5 to AEM as a Cloud Service is an outsourcing decision as well as a technical one: Adobe operates the platform and updates it continuously. Regulators expect the regulated firm to stay responsible, to control changes, and to keep records. This guide lists the rules most often raised and the Adobe features that help meet them. It is not legal advice; your compliance team decides how each rule applies.

Regulations that usually come up

RuleApplies toPoints relevant to a SaaS CMS
RBI Master Direction on Outsourcing of IT Services (10 April 2023, in force 1 October 2023)Indian banks, NBFCs, credit information companies and all-India financial institutionsBoard-approved IT outsourcing policy, risk-based due diligence, a written contract giving the bank access to data, logs and records and audit rights, RBI's right to inspect, business continuity and a clear exit strategy. Its cloud appendix calls cloud security a shared responsibility.
RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, in force 1 April 2024)Commercial banks, larger NBFCs, credit information companies, AIFIsDocumented change and patch management with a way to recover from failed changes; sign-offs from business users and application owners at each stage of a data migration; audit and system logging with regular monitoring.
IRDAI Information and Cyber Security Guidelines, 2026 (circular of 6 April 2026)Insurers, including foreign reinsurance branches, and insurance intermediariesReplace the 2023 guidelines; compliance expected from the current financial year. Read the guidelines themselves for the detailed controls.
EU Digital Operational Resilience Act, Regulation (EU) 2022/2554 (applies from 17 January 2025)EU credit institutions, insurers and other financial entitiesThe firm stays fully responsible; a register of information on all ICT contracts; due diligence and concentration-risk assessment; tested exit plans; minimum contract terms (Article 30), with audit and access rights for services supporting critical or important functions; controlled ICT change management (Article 9).

Adobe updates the platform; you can shape when

AEM as a Cloud Service updates itself. Adobe publishes maintenance release notes three to five days ahead, applies updates to development environments first, then stage and production, and stops the rollout if your functional or UI tests fail. There is no permanent opt-out, but there are two controls for regulated calendars:

  • Quiet hours: a daily window of up to 8 hours in which maintenance updates do not run.
  • Update free periods: 7-day blocks with no maintenance updates, up to three in any rolling 365 days, at least one week apart, planned up to a year ahead. Use them for quarter-end, year-end or a major launch.
  • Only the Business Owner and Deployment Manager roles in Cloud Manager can set them. Adobe notes they do not stop all infrastructure activity, and you cannot book them during Adobe's own maintenance exclusion periods (usually two or three a year).

Your own customer tests gate Adobe's updates. A good regression suite on stage is therefore part of compliance, not only quality: it is what stops a platform update reaching production if it breaks something you depend on.

Your own releases and freeze windows

  • Production pipelines deploy to stage first and to production only after approval, with options to pause before production and to schedule the production deployment.
  • Starting pipelines, approving go-live and scheduling production deployments are limited to named Cloud Manager roles (Business Owner, Deployment Manager, Program Manager); developers cannot do them. Map these roles to your change advisory board.
  • Approval and scheduling steps time out after 14 days, so a pipeline cannot sit half-deployed through a long freeze.
  • Deployments are rolling, without downtime, which makes it practical to release in agreed change windows.

Evidence and records

  • Adobe's compliance list includes AEM as a Cloud Service within Adobe Experience Cloud, for which it lists SOC 2 Type 2, ISO 27001:2022, ISO 27017, ISO 27018 and ISO 22301, among others. PCI DSS is listed only for Adobe Managed Services' enhanced security offering, not for AEM as a Cloud Service.
  • Cloud Manager keeps service logs (AEM error, request and access logs, dispatcher logs) for seven days. For longer retention, forward logs to your SIEM: Adobe documents forwarding to Splunk, Datadog, Elasticsearch or OpenSearch, Azure Blob Storage and HTTPS endpoints.
  • AEM's own audit logs (replication, page, DAM) can be purged by a maintenance task; Adobe recommends an external service for regulatory needs around uneditable audit logs.
  • Cloud Manager's activity page lists current and past pipeline executions for the program.

A migration plan that fits the rules

  1. Treat Adobe as an outsourcing arrangement: complete due diligence, contract review and exit planning before go-live, not after.
  2. Book update free periods for known freeze dates as soon as the program exists.
  3. Set up log forwarding to your SIEM before production traffic.
  4. Record sign-offs at each migration stage (content transfer runs, user acceptance, cutover), as RBI's IT governance direction expects.
  5. Map Cloud Manager roles to your change process and review access every quarter.

Questions

Can a bank stop Adobe updating AEM as a Cloud Service?

Not permanently. Quiet hours and up to three 7-day update free periods a year let you keep maintenance updates out of sensitive windows, and failing customer tests stop an update reaching production.

Is AEM as a Cloud Service PCI DSS certified?

Adobe's compliance list shows PCI DSS only for Adobe Managed Services' enhanced security offering. Keep card data out of AEM and handle payments in a PCI-compliant system.

Which Indian rules apply when a bank moves its website to a SaaS CMS?

Usually RBI's Master Direction on Outsourcing of IT Services and its IT Governance direction; insurers follow IRDAI's Information and Cyber Security Guidelines, 2026. Your compliance team decides whether the arrangement counts as material outsourcing.

Sources