What is Public-Sector Cloud Adoption?
Public-sector cloud adoption (CSAP, guidelines, audit), told as a procurement rule: move in to a security-checked building, at the grade your data earns.
Public agencies want to move into the shared building too, to save on cost.But it's public data — they can't just move in anywhere.
Move into just any building, and nobody can vouch that public data is safe.An uncertified building is too risky for public data.
Move in to a security-checked building, at the grade your data earns.Certified building, matching grade: that's how the public sector procures and adopts cloud.
Public agencies go through four steps, from grading data to post-move-in checks.The higher the data's grade, the fewer spots qualify.
The building's CSAP certification vouches only for the service's own safety inspection.How the tenant locks their own door (access and account settings) is still the tenant's job.
Public-sector cloud adoption means moving into a security-checked building (CSAP), at the grade that fits your data, through a set procedure.
To use private-sector cloud, a public agency first sets the grade (high/mid/low) of the data its system handles, then picks a service at that grade that has passed both CSAP (Cloud Security Assurance Program) and the National Intelligence Service's security review. Using a service without certification requires consulting the NIS on its security in advance. Usage standards follow a Ministry of the Interior and Safety notice, contracts follow public procurement procedures such as the digital-service contract program, and build projects above a set size get an IS audit. Certified services get a yearly follow-up review and a renewal review every five years. In April 2026 the science ministry and the NIS announced a plan to merge the separate CSAP and NIS steps into one NIS review and replace high/mid/low with N2SF's classified, sensitive, and open (C/S/O) grades. In September the NIS explained the draft and said it was considering a grace period of about a year after it takes effect; opinions were still being gathered, so it was not final at that point. The CSAP certification criteria itself — the building's own safety-inspection checklist — is covered on a separate page.
When grown-ups say it
- Public-sector cloud adoption
- The rule: move into a certified building, at the right grade. Covers the procurement process and ongoing checks too.
- CSAP
- The building's own safety-inspection certification. This page focuses on the move-in/adoption side.
- Data classification grade
- How sensitive a system's data is, split into high / mid / low. The higher the data's grade, the fewer spots qualify.
- Digital service contract program
- A program that pre-screens cloud services so agencies can contract them more easily. Agencies can contract directly or through the procurement service's digital-service mall.
- IS audit
- An independent firm's check of an information-system build project. Covered in depth in another PPE field. → the checker who watches the whole publishing run
- Private-sector vs government cloud
- A building run by a private company vs one run by the government. Putting public data in a private building requires security certification and review.
- Cloud service model
- Bare shell / interior done / move-in ready. The grade rule applies no matter which model. → pick one to rent
- Multi-cloud
- The strategy of spreading across several buildings. Agencies sometimes use multi-cloud too, for reasons like saving cost or preparing for disaster. → moving into several buildings at once