If your board or your regulator asked how you would leave your cloud provider, could you show a plan? We review each critical workload's dependence on provider-specific services, its data, identity, infrastructure templates, backups and runbooks, and tell you what an exit would take.
Cloud partner credentials
A cloud exit assessment checks how each critical workload could leave its current cloud provider, for another provider or your own data center, while the business keeps running. HabileLabs reviews dependence on provider-specific services, data, identity, infrastructure templates, backups and runbooks, and ends with an exit plan per critical workload. It covers technical readiness, not legal or compliance advice.
For RBI-regulated entities
RBI's Master Direction on Outsourcing of Information Technology Services was issued on 10 April 2023 and took effect on 1 October 2023. It applies to banks, NBFCs and other regulated entities. On exit, and for cloud services, it asks for:
The policy itself is expected to set out how you would leave a service provider.
Critical services keep running while the exit happens, and once it is complete.
Another service provider, or bringing the work in-house.
From the moment data enters the cloud to its permanent erasure.
This assessment covers technical readiness: what an exit would take for each workload, and what stands in the way. It is not legal or compliance advice, and it does not certify compliance with the Master Direction. Your compliance team and advisers decide what your policy needs.
Six areas that decide what leaving a cloud provider would take, reviewed for each critical workload.
Managed services make a system easier to run and harder to move. We review:
For each critical workload, we review:
Who and what can sign in has to be rebuilt wherever a workload goes. We review:
An environment built by hand is hard to rebuild anywhere else. We check:
A backup in the same account as the system it protects can be lost with it. We review:
An exit is a sequence of steps that someone has to carry out. We review:
At the end of the assessment you have four things you can act on.
Where each workload would go, another cloud provider or your own data center, how its data would move, and the order of the steps.
How much work and how much time each exit would take, so the exit strategy in your policy rests on estimates rather than assumptions.
What stands between you and a workable exit today, ranked by risk and effort: for example, environments built by hand, recovery copies kept in the same account, or restores never tested.
Ways to keep critical systems running during an exit or an outage, from a second region to recovery copies kept outside the primary account, sized to each system's recovery time and recovery point.
Client results on AWS
NBFC · Active-active DR99.99%uptime from an active-active disaster recovery architecture across the AWS Mumbai and Hyderabad regionsAavas Financiers →
IaC · AWS CloudFormationOver 80%less infrastructure deployment time, with security policies enforced automaticallyWonder Finance →
Housing finance · AWS WAF12M+malicious requests blocked by AWS WAF in the first yearWonder Finance →A review of how each critical workload could leave its current cloud provider, for another provider or your own data center, without stopping the business. It covers dependence on provider-specific services, data, identity and access, infrastructure templates, backups and recovery copies, and runbooks. It ends with an exit plan per critical workload, effort and time estimates, a ranked gap list and failover options.
Banks, NBFCs and other regulated teams that run critical systems on AWS or Microsoft Azure and need an exit strategy they can stand behind, and any team that has come to depend heavily on one cloud provider.
RBI's Master Direction on Outsourcing of Information Technology Services, issued on 10 April 2023 and effective from 1 October 2023, applies to banks, NBFCs and other regulated entities. It asks for an exit strategy in the IT outsourcing policy that keeps business continuity during and after an exit, with alternatives identified, such as another provider or bringing the work in-house. For cloud services, it expects the full data lifecycle to be covered, from entry into the cloud to permanent erasure.
No. The assessment covers technical readiness: what it would take to move each critical workload, and the gaps in the way. Whether your policy meets the Master Direction is for your compliance team and advisers to decide; the assessment gives them the technical facts to work from.
No. The point is to know that you could, how long it would take and how much work it would need. Gaps such as environments built by hand, recovery copies kept in the same account or restores that were never tested are worth fixing even if you never leave.
A disaster recovery review asks how fast a system comes back after a failure, usually on the same provider. An exit assessment asks how it would run somewhere else. The two share a lot: recovery copies kept outside the primary account or region, tested restores and current runbooks. For AWS accounts, we also offer a security and DR review against the AWS Well-Architected security pillar.
It can be planned that way. AWS, Microsoft Azure and Google Cloud all run more than one region in India, and your own data center is the other alternative. At Aavas Financiers, disaster recovery runs active-active across the AWS Mumbai and Hyderabad regions.
Not as published work: none of our published case studies covers a cloud exit or a move between clouds yet. The results on this page are AWS projects for lenders: active-active recovery across two AWS regions at Aavas Financiers, and infrastructure templates and AWS WAF at Wonder Finance. They show work an exit plan relies on, such as recovery in a second region and environments defined in templates; they are not exits. Cloud-to-cloud moves from Microsoft Azure and Google Cloud to AWS are part of our AWS migration service.
Fill in the form on this page. A cloud architect will get in touch to agree the scope, the critical workloads to include and the access needed. The first conversation is free.
Tell us which systems are critical and where they run. We will show what an exit would take for each one, and what to fix first.
