What Cloud Strategy for the Public Sector?

All public organizations collect, store, and process sensitive data: personal data on citizens and personnel working within the organizations (as defined by the GDPR and the CNIL), health data (which must be hosted by approved providers), sovereign data, or even 'defense secret' data. According to government announcements in early July 2018, the most sensitive data must be hosted in an internal Cloud; less sensitive data may be entrusted to French hosting providers in a dedicated external Cloud; and finally, less sensitive information may be hosted by actors (French or foreign) in an external Cloud.

However, hosting public data with American actors raises questions and concerns about their sovereignty, particularly with regard to the Cloud Act, which authorizes the American administration to requisition data from these providers. A framework note from the Secretary of State for Digital Affairs, following a consultation with key stakeholders in the summer of 2018, should soon clarify the doctrine adopted by the State, thereby helping all public bodies make the right choices based on the data they process.

To make the right choices, an audit of existing hosting infrastructures – internal or external – is essential to establish an IT transformation plan that complies with the required service continuity and security levels for the hosted data: evaluation of work needed to upgrade existing infrastructures, or potentially build a new data center, determination of criteria to challenge hosting providers, etc.

The government's initial guidelines suggest that public bodies will very often have to opt for a hybrid Cloud, combining their own data center and outsourced Cloud, to address the security challenges of different data types (ultra-sensitive, sensitive, and less sensitive) they process. Nevertheless, a hybrid cloud solution can prove suboptimal given the marginal cost it represents. Indeed, the economic relevance of outsourced hosting is not systematic, especially for an administration that already has its own data center. It is therefore necessary, before any decision, to compare the cost of each scenario: investment in increasing the capacity of an already operational in-house data center or recourse to an external Cloud.

One of the advantages of the Cloud is that it is accessible to all public bodies, regardless of their size, unlike an in-house data center solution, which requires a certain level of data to process and human resources to operate it. SaaS solutions (applications hosted in a Cloud) are already available in the UGAP catalog. In a PaaS (Platform as a Service) configuration, the layers managed by the end-user are limited to data and applications: it does not necessarily require an IT department for its management, and can therefore benefit a large number of public bodies. As for IaaS (Infrastructure as a Service), it implies having dedicated personnel to manage operating system and middleware layers: it is therefore more suitable for public bodies of a certain size that wish, for example, to deploy custom applications.

The contract with a Cloud provider often takes the form of a 'framework agreement'. However, according to Article 78 of Decree No. 2016-360 of March 25, 2016, relating to public procurement, the duration of framework agreements cannot exceed four years for contracting authorities and eight years for contracting entities, except in duly justified exceptional cases. This four-year period often proves too short given the upstream delays required to hybridize or relocate information systems, which take, on average, between 18 and 24 months. In addition, hosting contracts entered into by public entities benefit from an early termination right, as provided for by the General Administrative Clauses (CCAG) relating to Information and Communication Technologies (ICT).

These two points constitute obstacles for Cloud operators when responding to calls for tenders. It is therefore up to the public body to negotiate and justify the extension of the contract duration and the relaxation of early termination conditions.

Little discussed in the context of Cloud, the issue of connectivity is nevertheless fundamental for accessing hosted data and systems at all times, and securely. Before embarking on a Cloud project, public services must evaluate several parameters related to the telecom infrastructure: the variety and associated cost of available external connectivity resources, the quality of service provided on telecom links (bandwidth, latency, flow balancing device, etc.) but also the level of security implemented (encryption, firewall, anti-DDoS systems, etc.). The investments required to increase and ensure the reliability of network connectivity represent significant additional costs in this type of project.

Communities of communes, mergers of several municipalities, or pooling of resources in a shared area of expertise are all opportunities to overhaul information systems and mutualize resources. Mutualization allows associated public bodies to reach a critical size and, consequently, to amortize fixed costs over a larger user community, to negotiate more easily with Cloud hosting providers, to relieve IT teams, and to increase service levels through more industrialized operating procedures.

However, this requires the prior implementation of governance among the various stakeholders (e.g., local authorities, universities, or hospitals) and, depending on the nature of each party's needs, the design of a service catalog allowing them to access resources under equitable and transparent conditions.

The transformation towards Cloud technologies has consequences for work organization and, consequently, for personnel in charge of operating IT infrastructures. The required skills are indeed not the same, and some positions held by public agents may even become obsolete. It is necessary to anticipate, support change, skill development, and train personnel in the management of these new services.

The transition to the Cloud changes the accounting structure, moving from an investment logic (CAPEX) to an operating cost logic (OPEX). However, public actors, concerned about the proper use of their funds, are often reluctant to sanction an increase in operating budgets. This can be a major obstacle to the adoption of outsourced Clouds, even if they ultimately prove more economical. It is then up to public authorities to adopt a total cost logic (CAPEX + OPEX) to correctly evaluate the financial weight of a hosting project in the long term, associating it with the benefits derived from modernizing public information systems, both in terms of services rendered, efficiency, and data security.