Government Cloud Framework for Data Security
The Indian government has introduced new guidelines for managing government databases and applications, particularly focusing on ensuring data security through sovereign cloud systems. These guidelines aim to protect sensitive and critical information from being hosted on commercial public cloud providers.
Data Categorization
- Top Secret and Secret Data:
- Not permitted to be hosted on any cloud platforms.
- Category A:
- Includes data whose unauthorized disclosure can damage organizational security and affect national interests.
- Examples: Aadhaar, PAN, UPI, Voter ID, tax systems.
- Must be hosted on government cloud services or sovereign cloud providers notified by MeitY.
- Category B:
- Comprises applications and data primarily for official use, not requiring strict protection.
- Includes data like welfare schemes, public grievances, and events.
Implementation and Operational Measures
- Ministries can use a "nomination" route for faster onboarding of MeitY-backed service providers, bypassing the global tendering process.
- Focus is on building sovereign cloud capabilities domestically to ensure control and access remain with the government.
Concerns and Objectives
Amidst concerns over potential "backdoor access" due to foreign-origin cloud systems, the new framework aims to insulate confidential datasets and maintain legal immunity from sharing data with external entities.
