Oslo Economics, in collaboration with PROMIS and Systra (formerly Atkins Norway), has quality assured the Norwegian National Security Authority (NSM) concept choice study “National Cloud Service.” The central question in the concept choice study is how Norway can ensure efficient and secure storage of sensitive data within the government using cloud technology.
Cloud technology enables efficient and flexible data storage, and the use of cloud services for data storage and processing has increased and is expected to further increase in the future. The supplier market for cloud services is concentrated and dominated by a few international providers. These providers often have long value chains that cross multiple national borders and are thus subject to the jurisdiction of other countries. In addition, several countries have introduced regulations that allow authorities to access data from businesses within their jurisdiction, and there are different regulations in place that restrict how different data can be processed and where it can be stored. This makes it difficult for businesses to use cloud services for sensitive data.
We support the NSM’s assessment that the current regulations should be clarified. However, our conclusion is that there is currently not enough information to make a final concept choice, and that some additional analyses should be conducted before a final concept choice is made. Furthermore, our assessment is that a private state-owned cloud service will cost significantly more than a cloud service provided by an external supplier, may result in less flexible cloud services, and we are uncertain about the advantages this will provide in terms of enhanced security. Therefore, we believe it is necessary to detail which type of data should be included in the cloud solution, and a risk and vulnerability analysis should be conducted, considering, among other things, the consequences of storing data in a public versus private cloud, to determine if parts of the data volume can be stored in a public cloud. Additionally, we believe that a closer evaluation of the state’s resource capacity to operate a national cloud service and a new assessment of the possibilities for collaboration between businesses should be conducted.
The reports are available here (in Norwegian).
