IT ministry begins accrediting cloud providers under national policy

ISLAMABAD: The Ministry of Information Technology and Telecommunication has started the registration process for cloud service providers under the Pakistan Cloud First Policy, as the government moves to enforce accreditation standards aimed at protecting public and national data.

According to the ministry, six applications for accreditation have been received so far. The government had earlier introduced strict eligibility requirements for cloud service providers under the policy framework.

IT Minister Shaza Fatima said the ministry had set stringent security and quality benchmarks for providers seeking accreditation. She said applicants would have to undergo a rigorous security review as well as an audit by a third-party auditor registered with the Pakistan Computer Emergency Response Team to ensure the safety of government data and the data of Pakistani users from cyber threats.

Speaking about the policy, the minister said it was the first time that a framework had been put in place to ensure that sensitive Pakistani data would be stored on servers physically located inside the country.

"For the first time, the policy ensures that Pakistan’s sensitive data is stored on servers physically located within the country, which will help keep national data under Pakistan’s legal control"

She added that under the Pakistan Cloud First Policy, all public sector entities, including federal and provincial departments, would be required to use cloud services for new IT projects instead of setting up separate data centres.

"Under the PCFP, all public sector entities (PSEs), including federal and provincial departments, are required to use cloud services for any new IT project instead of building their own separate, expensive data centres"

Provincial alignment and oversight

Shaza Fatima said implementation of the transition had already started and that the provinces had approved their own versions of the policy in line with the federal model. She said the ministry had created a Cloud Office to support cloud adoption across the public sector and to manage the accreditation process for service providers.

The minister also said specialised Cloud Acquisition Offices would be set up in each province to help departments procure cloud services securely and more efficiently.

"For the proper management of the federal and provincial cloud policy model, the MOIT has established a ‘Cloud Office’ to facilitate the adoption of cloud across the public sector and accreditation of CSPs, while specialised ‘Cloud Acquisition Offices’ will be established in each province to help departments buy the services they need safely and quickly"

A senior ministry official said accreditation was necessary because both government clients and private-sector users were not fully aware of the safety standards followed by cloud service providers. The official added that registration would also help the government track investment in cloud services and avoid unnecessary spending that could lead to inefficient use of resources.

Economic rationale

A ministry report said the promotion of local cloud services could help conserve foreign exchange, noting that substantial sums were currently being spent on imported IT services. Shifting to domestic cloud providers would keep more of that spending within Pakistan and reduce pressure on foreign exchange outflows.

"By moving to local cloud providers, Pakistan will retain that money domestically and reduce foreign exchange outflows"

The same report said implementation of the policy would be supervised by a Cloud Board led by the IT secretary, with representation from all provinces to support coordinated rollout across the country.