Government agencies will have more room to use commercial cloud services. This is stated in a letter sent to the House of Representatives. Until now, government agencies were only allowed to use their own cloud services.
Working in "the cloud" can bring many benefits. When used properly and securely, the cloud can provide an innovative, transparent and flexible digital Rijksoverheid. Until now, the government has not worked with commercial cloud services because they can also involve risks. Therefore, when using the cloud, strict security and privacy conditions apply.
Government agencies are required to conduct a risk analysis in advance;
The cloud should not be used to store or process state secret information;
No services may be purchased from suppliers with an active cyber program directed against Dutch interests.
The new cloud strategy replaces the current policy, which dates back to 2011. In that time, the government did not yet use commercial cloud services. In the new situation, government organizations may purchase cloud services externally. All storage and processing of personal data takes place in a responsible manner that complies with applicable privacy requirements.
The chief information officer of the State will work with the CIOs of the relevant ministries to develop a guideline. CIO Rijk monitors the application of this policy. Compliance monitoring is the responsibility of the Court of Audit, Audit Service Rijk and Autoriteit Persoonsgegevens.
