Clarified Offshore cloud hosting rules

The New Zealand Government is expected to release new guidelines for the implementation and use of cloud services in the next few months, including clarifying if, when and how offshore cloud services can be used.

A Department of Internal Affairs spokesperson says work is continuing to develop risk and assurance frameworks and guidance for the use of cloud computing services by government agencies.

“Updated frameworks and guidance will be rolled out to government agencies as part of the wider ICT assurance framework over the next few months,” the spokesperson says.

The Department is already developing a range of “foundation” all-of-government services, including a standard office productivity offering and infrastructure as a service platforms. However, to date a cautious approach has been observed and onshore hosting of cloud services has been the rule.

New guidelines are expected to clarify when and what kinds of data might be hosted outside the country through the creation of data classification and governance framework to protect ownership, control, availability and management of data in the cloud.

That will potentially allow New Zealand government agencies to access at least some of the economies of scale available from offshore cloud providers that cannot be generated within the country.

Meanwhile contracts with preferred suppliers for all-of-government desktop-as-a-service (DaaS) are expected to be finalised very soon, an October update on the all-of-Government ICT project says.

This service could play a key role for any agencies wanting to migrate from Windows XP, which is now out of support.

DaaS will deliver traditional and virtual desktops, including providing and operating virtual desktop infrastructure, building, deploying and patching desktop operating systems; the delivery of applications to the desktops; and onsite support. It will also cover application packaging, including patching and updating and desktop hardware, either by managing procurement or providing leased hardware.

Using DaaS is expected to become mandatory.

Similarly, preferred vendors for enterprise-content-management-as-a-service are expected to be announced soon after the management of the project was handed to the Department of Internal Affairs from the Ministry of Primary Industries.

The scope of the opt-in service includes document and records management, workflow, collaboration, taxonomy and metadata management, including auto classification and support and management in a mobile environment.

While a common web platform was launched last month and a shared identity and access management system, called RealMe, in July, other areas are still works in progress.

The office-productivity-as-a-service project (OPaaS) team is giving priority to email - including archive and data loss prevention - and calendar services, rather than word processing and spreadsheeting.

“Other services may be brought on board in later streams if there is enough agency demand. We expect to offer the email and calendar services to agencies early in 2014,” the update says.

Infrastructure-as-a-Service (IaaS) has been offered for some time, with a Datacom and Revera (now owned by Telecom NZ) announced as providers in late 2011. They were later joined by IBM.

IaaS is an all-of-government pay-as-you-go capability for data centre hosting, virtual computing, storage, back-up and restore services.

“There has been strong interest and uptake of the service, with close to 50 government organisations having adopted aspects of the service,” the DIA spokesperson says. “The service model is maturing through increased usage and supplier expertise.”

The latest government body to shift towards IaaS is the Real Estate Agents Authority, which is planning a new licensee self-service portal as well as seeking support and development services for Microsoft CRM\Sharepoint and the Authority's website. It is mandating IaaS as the platform.