Title page 1

Contents 5

Acknowledgements 4

Introduction 7

Cloud and Data Center Regulation Rapid Assessment Tool 11

1. Demand: Promoting Government Cloud Adoption 15

1.1. INCLUSION IN NATIONAL DIGITAL STRATEGIES AND ROADMAPS 15

1.2. GOVERNMENT CLOUD POLICY WITH A RISK-BASED APPROACH 17

1.3. DATA CLASSIFICATION AND HANDLING POLICY 21

1.4. MODERN CLOUD PROCUREMENT 24

1.5. STANDARDS, LABELS AND CERTIFICATIONS 29

1.6. INSTITUTIONAL ORGANIZATION 31

2. Supply: Attracting Private Capital 34

2.1. INTERMEDIARY LIABILITY PROTECTION 34

2.2. PERMITS AND LICENSES 36

2.3. COMPETITION AND BUSINESS CLIMATE 40

2.4. TAX POLICY AND INCENTIVES 42

2.5. PPP FRAMEWORKS 43

3. Ensuring Privacy, Security, and Sustainability 46

3.1. DATA PROTECTION 46

3.2. MINIMIZING DATA LOCALIZATION REQUIREMENTS 48

3.3. CYBERSECURITY 52

3.4/3.3. ENVIRONMENTAL SUSTAINABILITY 57

Annex 1: SUMMARY OF RECOMMENDATIONS 60

Annex 2: CLOUD AND DATA CENTER REGULATION RAPID ASSESSMENT TOOL 64

TABLE 1. Cloud and Data Center Regulation Rapid Assessment Tool 12

TABLE 2. Comparison of traditional IT procurement and modern cloud procurement 25

TABLE 3. Institutional design models for digital transformation 32

FIGURE 1. Comparison of various cloud and data center services 7

FIGURE 2. Framework for cloud and data center market development 9

FIGURE 3. Illustration of typical low-maturity scenarios (no data classification and use of on-premises storage) and high-maturity contexts... 23

Boxes 6

BOX 1. Cloud deployment models 17

BOX 2. Contracting considerations in SLAs 27

BOX 3. Cloud service models 28

BOX 4. Is the cloud riskier than privately-owned infrastructure? 54