WHITE PAPER

Zscaler – Compliance with
Framework for Adoptionof Cloud Services by SEBI
Regulated Entities (REs)©2024 Zscaler, Inc. All rights reserved.

Introduction
In March 2023, the Securities and Exchange Board of India (SEBI) published the “Framework for Adoptionof Cloud Services by SEBI Regulated Entities (REs)” (Framework). The Framework provides Governance,Baseline Security, Legal and Regulatory requirements that REs should adopt to effectively manage theircloud service providers (CSPs), key risks, and mandatory control measures which REs need to put in place
before adopting cloud computing.
Zscaler is not a RE which is bound to the principles and requirements of the Framework. This whitepaper
describes the security controls and processes that Zscaler has in place, and REs may, subject to theDisclaimer below, utilize this information to conduct their due diligence on how they may use Zscaler
Products whilst meeting the Framework requirements .

Key Principles of the SEBI Framework
The SEBI Framework consists for 9 Principles ofGovernance, Risk andComplliance

Selection of CSPs

Data Ownership andLocalization

Responsibility of the
RE (to CSPs)

Due Diligence by the
RE (CSPs)

Security Controls

Contractual Obligations

BCP, DR & Cyber Resilience

Concentration Risk
Management

What does Zscaler do?
Zscaler’s Zero Trust Exchange is a purpose-designed, cloud-based SASE platform that securely connects
users, devices, and apps using business policies over any network. Zscaler provides RE with cloud based
secure web gateway with multiple inline security capabilities for securing their web traffic, replacing thearchaic traditional network security solutions.
Zscaler does not host any infrastructure, Deployment (VM/ containers) or managed application services
for the RE on its Zero trust platform cloud and Zscaler does not manage a customer enterprise’s security
controls directly. The control of the cloud platform is retained by the RE itself. All requests, configurations,log meta data are owned and managed by the RE.
Further, a few key questions about Zscaler company, our customers, our technology, and products areanswered here: zscaler.com/company/faqs©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

02

RE’s Compliance with SEBI Framework
Subject to the Disclaimer below, RE may utilize the information below to assess how it may fulfill its
obligations under the SEBI Framework when using Zscaler Products.

Principle 1: Governance, Risk andCompliance Sub-Framework

Principle 2: Selection of Cloud
Service Providers

REs (Customers) are responsible for developing

Our Public service edges in India are in Delhi,

and implementing their Cloud Governance, Cloud

Mumbai, and Chennai.

risk management and compliance management
programs and processes to identify, monitor,
measure, and manage the reporting of theirinternal risks assessments.
Zscaler is a publicly traded company. Our financial
or fiscal year is from August 1 to July 31. We
demonstrate consistent, strong revenue growth.
For more information related to our financials andcorporate governance, please refer:

The latest Zscaler global Data centers map can besighted at - trust.zscaler.com/zscaler.net/datacenter-map
Zscaler uses our Third-Party Risk Management
Program, including process to conduct due
diligence and contractual diligence, to manage
our vendors (e.g., subcontractors, sub processors)that has safeguards in place to guarantee that our
security policies and standards are met by these

ir.zscaler.com

vendors used to deliver the contracted services.

ir.zscaler.com/corporate-governance/

Zscaler maintains a current list of its sub-governance-documents

processors at www.zscaler.com/legal

Zscaler has in place an extensive risk assessment
and risk treatment plan. A formally documented
risk assessment process is in place to help guidethe risk assessment and treatment processes.
Zscaler uses a risk assessment methodology
based on the NIST 800-30 standard.

subprocessors

Principle 3: Data Ownership andData Localization
The RE (Customers) retain complete data
ownership for all their data. With all Zscaler
solutions, the customer owns the data and is thedata controller. REs shall manage their accounts
and security configuration for their organization
via their admin portals.
As a “data processor” under GDPR, Zscaler
process and/or store limited personal data (e.g.,
IP addresses, URLs, user groups and departmentsfrom a corporate directory) only.

©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

03

We do not process or store any special orsensitive categories of personal or non-publicdata (e.g., credit card, financial, or PHI). For
more information, see Exhibit A of Zscaler’s
Data Processing Agreement: www.zscaler.com/
privacy/dpa.
In case the RE might be required to forward web
traffic to Public Service Edges in a specific region
only (in this case India), note that if a remote user
has traveled outside of specific region, then web

Principle 4: Responsibility of theRegulated Entity
Zscaler has a standard clickthrough terms EUSA
document for their customers.
The Roles and responsibilities (for customer andZscaler) are defined in our End User Subscription
Agreement in Section 4.5 and 4.6. Please refer:
www.zscaler.com/legal/end-user-subscriptionagreement

traffic might be forwarded to a ZIA Public Service

Further legal documents such as acceptable use

Edge located outside of your selected region.

policy, Data privacy and protection template canIn such a case, RE can configure a subcloud tobe found at www.zscaler.com/legal/overview

ensure that traffic is forwarded to your preferred
ZIA Public Service Edges.

Our public Service Level agreements can be foundat SLAs on our public-facing SLA web page:The customer web request data is stored in the

www.zscaler.com/legal/sla-support

form of transaction logs by Zscaler. The logs aretokenized, rendered unreadable, and thus do notcontain any string identifiers. The token dictionary

Principle 5: Due Diligence by the RE:

is stored on separate systems from the log files

Zscaler is a publicly traded company. Our financial

and requires different access privileges.

or fiscal year is from August 1 to July 31. We

RE in India can opt for storing logs in Zscaler’s
India Hosted In-Country Logging Hub Site byrequesting the same during the contracting phaseand adding the location-based Log SKU’s intheir contracts.
These logs can be streamed to SIEM solution/
Server as desired by the RE by using the Nanolog
streaming service (NSS) for ZIA and log streaming
services (LSS) for ZPA. The NSS and LSS services
need to be subscribed to and configured by the
RE. This helps the RE have all the logs available intheir preferred location that is managed by themin India and helps meet SEBI regulation for Data
Localization and Retention.

demonstrate consistent, strong revenue growth.
For more information related to our financials andcorporate governance, please refer:ir.zscaler.com
ir.zscaler.com/corporate-governance/
governance-documents
The Zscaler Compliance team supports a wide
variety of International compliance programs
and government certification programs designed
to certify that our cloud operations meet thehighest standards for security and compliance.
For example, Zscaler is certified for both ISO
27001 and ISO 27018 as well as SOC 2 Type II.
For a full list of our certifications, please visit
our compliance web page: www.zscaler.com/
compliance/overview©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

04

Principle 6: Security Controls
Security of the Cloud
Zscaler has comprehensive security mechanisms
in place that cross over many areas such as ourcloud infrastructure, products, admin portals, data
centers, and customer data to ensure Security of
its zero trust Cloud.
Vulnerability and patch management programs
are reviewed and part of our annual ISO and
SOC2 type II reviews which are conducted by an
external auditor.

The enterprise monitoring applications aremonitored by IT personnel in real time and are
configured to send alert notifications to IT/
NOC personnel when predefined thresholds are
exceeded. Real time monitoring stats can beviewed at - trust.zscaler.com
For security of the cloud the as a first step the
Zscaler zero trust exchange confirms that theuser is who they say they are. Once validated,
access rights are verified based on context andthe principles of least-privileged access to ensure
users only have access to the applications for

Zscaler performs quarterly vulnerability

which they have been authorized. Zscaler’s Zeroassessments and annual penetration tests toTrust Exchange enhances known access control

identify any weakness or deficiencies in our

principles (least privilege, segregation of duties)

environment that could affect the performancethem through its robust identity and accessof the cloud platform and/or affect the security,

management capabilities:

availability, and confidentiality of the system.
RE can obtain confidential reports (e.g., pen test
results, vulnerability scan reports, etc.) after
agreeing to an NDA through your designatedZscaler Account team, who will place a request
on your behalf through our internal compliance
web page
Zscaler has implemented a set of logging andmonitoring tools that are configured to collectdata from system infrastructure components tomonitor system performance, potential security
threats and vulnerabilities, resource utilization
and alert IT operations upon detection of unusual
system activity or service requests. The inscope systems are monitored using enterprise

1.

Least Privilege: ZTE offers role-based access
control (RBAC), allowing REs to define andenforce access policies based on users’ roles,
department, and responsibilities. Users
are granted access only to the resources
necessary for their tasks, adhering to theprinciple of least privilege.

2. Segregation of Duties: ZTE’s RBAC systemenables RE to define and separate roles andresponsibilities within the platform. This
ensures that users and administrators are notgranted conflicting permissions that could
compromise security.
3. Timely Detection of Incidents: ZTE

monitoring applications that track system

incorporates advanced monitoring andperformance, responsiveness, availability, andanalytics features, enabling RE to monitor user

vulnerabilities.

activity in real-time. Suspicious or anomalous
behaviour triggers alerts, facilitating swift
incident detection and response.

©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER05

In addition to these principles, ZTE provides

Security in the Cloudrobust authentication and authorization

RE will configure, manage and maintainmechanisms, including integration with multi-

security, hardening and access control for all

factor authentication (MFA) and single sign-on

its infrastructure, applications and endpoints(SSO) capabilities. These features enhance identity

deployed by them in the cloud / onsecurity, ensuring that only authorized users gain

their premises.

access to sensitive resources.

Zscaler provides protection against advanced

Zscaler integrates with leaders in identity andthreats by using multiple inspection techniques

access management (IAM) as well as identity

for identifying web threats. Zscaler Internet

governance and administration (IGA), Please

Access (ZIA) scans all traffic bi-directionally forcheck our support for all leading identity andmalware/spyware that passes through its cloudaccess providers at: www.zscaler.com/partners/

and offers an SLA that states the service willtechnology/identity-access-management

capture 100% of all known viruses transmitted.

The Zscaler data security model uses data
segregation as the key mechanism to ensure
security. Zscaler security model ensures
separation of data elements to minimize
information leakage if a single component iscompromised. Information in Zscaler logs cannot
be extracted without access to multiple cloudcomponents (Nanolog, Public Service Edge,

In addition to detecting malware, Zscaler
provides protection against advanced threatsthat would typically not be blocked by traditionalanti-malware engines. For example: Botnet
Communications, Browser Exploitation, PhishingSites, Cookie Theft, Anonymizer Sites, Use of
Vulnerable ActiveX controls, Injected Code (zeropixel iframes, obfuscated code, etc.)

and Central Authority). No single employee has

Zscaler helps RE maintain the security postureprivileged access to all three components. Further

in the cloud by replacing their legacy network

all Administrative level access is protected using

security solutions to stop advanced attacks andseveral layers of security:

prevent data loss with a comprehensive zero trust• The cloud is only accessible through jump

approach that includes:

systems located inside the Zscaler Network• Zero Trust Network Access: Replace legacy

which are logically and physically segregated

VPNs with a secure, direct connection to private

from the production cloud.

apps, not the network, for better security and a• Access to the restricted jump systems requires
multi-factor authentication (MFA)• Each node is protected by a built-in firewall andadministrative traffic is protected by AES 128, or
AES 256 encryption.
• Once the Network access has been granted,

superior user experience via native integration
with Zscaler Private Access• Cloud Access Security Broker: Secure cloudapps with integrated CASB to protect data, stopthreats, and ensure compliance across your
SaaS and IaaS environments.

the administrators are authenticated with ausername and password and an individual
certificate (public key authentication)©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

06• Cloud Data Loss Prevention: Protect data in

RE should leverage our ISO and SOC 2 Typemotion with full inline inspection, including

II compliance to satisfy audit requirements.

Exact Data Match (EDM), Indexed Document

Reports can be shared with a customer under

Matching (IDM), and machine learning.

NDA. Zscaler adheres to The National Institute• Firewall & IPS: Extend industry-leading
protection to all ports and protocols and replaceedge and branch firewalls with a cloudnative platform.
• Sandbox: Stop never-before-seen malware inline with shared protections sourced from 360+
billion daily transactions per day and 500+
trillion daily signals, including quarantine ofzero-day threats, for AI/ML cloud effect.
• Cloud Browser Isolation: Make web-basedof Standards and Technology NIST 800-53
ensuring sufficient protection of confidentiality,
integrity, and availability of information andinformation systems. Zscaler also has several
Global government certifications which include
FEDRAMP (USA), C5 (Germany), ARPA(Australia), MTSCS Level 3 (Singapore)Principle 8: BCP, Disaster Recovery &Cyber Resilience

attacks obsolete and prevent data loss byZscaler tests our formal Business Continuity/

creating a virtual air gap between users, theDisaster Recovery Plan (BCP/DR) at least annually.

web, and SaaS.

Third-party auditors also verify our BC/DR• Digital Experience Monitoring: Reduce IT
operational overhead and speed up ticket
resolution with a unified view of application,
Cloud Path, and endpoint performance metrics
for analysis and troubleshooting.

Principle 7: Contractual andRegulatory Obligations
Zscaler has a standard clickthrough terms EUSA
document for their customers.

Plan and test results annually as part of our ISO
27001 and SOC 2 Type II certifications. Our ISO
27001 and SOC 2 Type II attestation reports areavailable to customers (upon request and with
an NDA) through a request form on our publicfacing compliance web page: www.zscaler.com/
compliance/overview
At Zscaler, we understand how critical Zscaler
is to our customers’ organizations and make thereliability, availability, and serviceability (RAS)of our products a top priority for the company.

The roles and responsibilities (for customer andZscaler products have a long history of near-

Zscaler) are defined in our End User Subscription

perfect uptime and are backed by best-in-class

Agreement in Section 4.5 and 4.6.

service level agreements (SLAs)

Please refer: www.zscaler.com/legal/end-usersubscription-agreement

Zscaler provides Zscaler’s Disaster Recovery
Solution - a customer-controlled business

Further legal documents such as acceptable use

continuity solution to keep organizations

policy, Data privacy and protection template canoperational even during a catastrophic event that

be found at www.zscaler.com/legal/overview

might interrupt the global Zscaler cloud.

©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

07

With Zscaler’s Disaster Recovery solution,

Mature operational procedures allow for cloudcustomers can control what business-critical

updates with no operational effect on customers.

private, or SaaS applications users can accessWith data centers in many countries across theeven during a black swan event by the switch

world, combined with our ability to handle anyof operations from normal mode to DR mode

user on any node, Zscaler can provide athrough a single click and configure option. Refer

99.999% SLA.

www.zscaler.com/blogs/product-insights/
zscaler-strengthens-sse-offering-disasterrecovery

For additional information about our resilience
approach, please read our resilience whitepaperat www.zscaler.com/resources/solution-briefs/

Zscaler features several measures for resiliency,

zscaler-disaster-recovery.pdf

high availability and minimal downtime. Our
Public Service Edges have significant fault
tolerance capabilities. They are deployed in
active-active mode to ensure availability andredundancy and Zscaler monitors and maintains
its Public Service Edges to ensure continuous
availability. Our recommended deployment
approach has our customers’ users and locations
using a primary and secondary Public Service
Edge, with automatic failover.

Principle 9: Vendor Lock-In andConcentration Risk Management
RE shall evaluate the concentration risks
associated with cloud services. Zscaler does
not provide/ host any Infrastructure, VM’s,
Containers, applications for customers in thecloud and does not store any customer data on
its cloud. The log data can be readily streamed to
any location / SIEM the customer selects. Zscaler
ZTA is a cloud/ network agnostic solution, hence
concentration risks are not applicable.

Disclaimer: This document has been created by Zscaler for informational purposes only, and is designed to help Zscaler’s prospective / existingcustomers understand the legal and regulatory requirements that may apply to their use of Zscaler Products. You may copy and use this document foryour internal reference purposes only, provided that you agree that this document: (a) should not be relied upon as legal advice; (b) is provided “as-is”;(c) represents current Zscaler Products, which are subject to change without notice; (d) does not provide you with any legal rights to any intellectual
property in any Zscaler Product; and (e) does not create any commitments or assurances from Zscaler, Inc. and its affiliates. ZSCALER MAKES NO
WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. The responsibilities and obligations of Zscaler to
its Customers are governed by the terms of the End User Subscription Agreement, and this document is not part of, nor does it modify, any agreement
between Zscaler and its Customers. We encourage you to consult with your own legal advisor with respect to how the contents of this document may
apply specifically to your organization, including your unique obligations under applicable law and regulations

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient,resilient, and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks
and data loss by securely connecting users, devices, and applications in any location. Distributed acrossmore than 150 data centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline
cloud security platform. Learn more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134© 2024 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,
ZIA™, Zscaler Private Access™, ZPA™, Zscaler Digital
Experience, and ZDX™,and other trademarks listed at
zscaler.com/legal/trademarks are either (i) registeredtrademarks or service marks or (ii) trademarks orservice marks of Zscaler, Inc. in the United States
and/or other countries. Any other trademarks are theproperties of their respective owners.

zscaler.com