Cabinet decisions — public cloud services

In April 2023, Cabinet agreed to a refreshed Cloud First policy.

This policy and previous Cabinet decisions require NZ government organisations to take the following actions before using public cloud services.

Move away from on-premise systems and infrastructure

• Adopt public cloud services in preference to traditional information and communications technology (ICT) systems.
• Do not invest in on-premise ICT infrastructure unless information meets specific criteria or is approved by the GCDO.

GCDO: Digital Investment Office

On-premises ICT investment — assessment process and exceptions criteria

Safely store information

• Only store data classified as RESTRICTED or below in a public cloud service, whether it’s hosted onshore or offshore.
• Over time, host RESTRICTED information in a New Zealand-based data centre, where a suitable onshore service exists.

Classify information

Have and use a cloud plan

• Have a plan for how to use public cloud services in your organisation.

Cloud plans

Te ao Māori perspectives

• Consider te ao Māori perspectives for Māori data when making decisions about adopting cloud services.

Māori interests in public cloud

Sustainability principles

• Consider high-level sustainability principles in cloud-adoption decisions.

Sustainability when choosing public cloud services

Assess the risks

• Make adoption decisions on a case-by-case basis following a risk assessment.

Risk discovery tool for public cloud services

Create or improve your organisation’s process for assessing risks

Start using public cloud services

Benefits of using public cloud services

How to adopt public cloud services

More information

Public cloud versus other types of cloud

Cabinet minutes and papers for public cloud services

Information system — National Institute of Standards and Technology