Dealing With Data Sovereignty: Why Government Agencies Must Use Cloud Services

One of the common objections I hear from schools around New Zealand when the topic of moving to the cloud comes up is “what about the security of my data? Who owns it if it is hosted overseas?”

Data sovereignty is a big deal and schools should definitely be thinking about these types of questions, however the New Zealand Government has significantly simplified this conversation by posting online about why Government Agencies must use cloud services:

Cabinet’s Cloud First policy requires agencies to adopt cloud services in preference to traditional IT systems because they are more cost effective, agile, are generally more secure, and provide greater choice.

Cabinet requires agencies to adopt cloud services

Cabinet requires agencies to:

  • adopt cloud services in preference to traditional IT systems
  • make adoption decisions on a case-by-case basis following a risk assessment 
  • only store data classified as RESTRICTED or below in a cloud service, whether it is hosted onshore or offshore

The last bullet point is especially important – it’s unlikely any schools store data at a security classification level higher than “RESTRICTED” – leaving only Confidential, Secret and Top Secret data not being permitted in the public cloud.

The Government requirement outlines the reasons why they mandate a cloud-first approach for agencies, with the value offering being:

The key benefits of cloud services for the Government are:

  • more cost-effective IT services
  • increased agility from quicker deployment times
  • greater choice
  • improved security.

From an Office Productivity perspective, the article also shows significant usage of Microsoft Office365 usage amongst Government agencies:

There is strong demand for adopting office productivity services, with over half of agency CIOs stating in our October 2016 survey their agencies intend to use these services within the next 12 months. Almost all of these agencies intend to use Microsoft’s Office 365, Skype, Azure Active Directory and Azure Services

From a school leadership perspective, this mandate from the New Zealand government simplifies the decision making process somewhat, by effectively saying the public cloud offerings outside of New Zealand are acceptable for all data classified as RESTRICTED or below. The closest Azure data centers to New Zealand are located in Sydney and Melbourne respectively:

regions-map

I am always keen to discuss what I've written and hear your ideas so leave a reply here...

%d bloggers like this: