Cloud First policy
Government organisations must use public cloud services, when possible, for information systems. This is the NZ government’s Cloud First policy. This requires NZ government organisations to take the following actions before using public cloud services.
Updates to guidance for public cloud services
The links to guidance from this page are current. The Government Chief Digital Officer (GCDO) regularly releases new or revised guidance. Check back for updates on this website or by joining the Cloud Capabilities Network.
Move away from on-premise systems and infrastructure
- Must adopt public cloud services in preference to traditional information and communications technology (ICT) systems.
- Must not invest in on-premise ICT infrastructure unless information meets specific criteria or is approved by the GCDO.
- Must adopt standardised, commercial off the shelf (COTS), options through the GCDO Cloud Framework Agreements (CFAs) where available.
GCDO: Digital Investment Office
On-premises ICT investment — assessment process and exceptions criteria
Safely store information
- Must only store data classified as RESTRICTED or below in a public cloud service, whether it’s hosted onshore or offshore.
- Can locate their data classified RESTRICTED and below offshore in cloud infrastructure as long as it is stored in cloud infrastructure.
- Should over time, store RESTRICTED information in a New Zealand-based data centre, where a suitable onshore service exists.
Have and use a cloud plan
- Must have a plan for how to use public cloud services in their organisation.
- Must implement a multi-cloud policy that ensures resilient digital infrastructure, maximises flexibility and utility, and avoids being overly dependent on any specific suppliers.
Use cloud optimisation
- Must use cloud optimally to manage costs through use of cloud management (optimisation) tools.
Consider te ao Māori perspectives
- Must consider te ao Māori perspectives for Māori data when making decisions about adopting cloud services.
Māori interests in public cloud
Consider sustainability principles
- Must consider high-level sustainability principles in cloud-adoption decisions.
Sustainability when choosing public cloud services
Assess the risks
- Must make adoption decisions on a case-by-case basis following a risk assessment.
Risk discovery tool for public cloud services
Create or improve your organisation’s process for assessing risks
Start using public cloud services wherever possible
Benefits of using public cloud services
How to adopt public cloud services
More information
Public cloud versus other types of cloud
Cabinet minutes and papers for public cloud services
Information system — National Institute of Standards and Technology
Utility links and page information
Last updated
