The government's lead digital agency is designing a replacement for its current IaaS panel agreements now they no longer meet its definition of cloud.
The Department of Internal Affairs is also scoping a new public cloud data centre certification scheme and hiring a team leader to manage that programme.
"A project to design a replacement for the IaaS panel agreements that has a more flexible set of arrangements as well as a common approach to support agencies using cloud services has been initiated," a Cabinet paper released last month said.
"This project will provide a pathway to continue IaaS services beyond the current agreements and a managed transition to cloud services, thereby ensuring continuity and reliability in the service."
Design of the new IaaS service was expected to be completed this month with implementation to follow.
At the same time, DIA's cloud policy refresh includes a plan to update how agencies manage jurisdictional
risk, guidance for the cloud risk assessment process and how data centre certification will be implemented.
Continuing with the current decentralised certification approach would mean each agency would be required to undertake their own process.
"A centralised certification process for new hyperscale cloud data centres is under development to provide clarity on certification for hosting government data, with standardised requirements and an assessment tool to ensure consistency across providers," the Cabinet paper said.
Although not mandatory, DIA expected providers and agencies would support centralised certification as this would streamline certification and accreditation processes and reduce duplication of work.
The costs of centralised certification were expected to be met by providers through a fee based on the cost of the process.
"This process will help provide confidence in physical and personnel security posture, as well as mitigate against any ownership, control and supply chain risks," the paper said.
"We note each agency will still be responsible for accreditation and management of residual and agency-specific risks."
DIA is now advertising for a new team leader to manage security assurance and risk and to work collaboratively across all of government ICT service providers to implement the certification and deliver security assurance for all of government common capability products and services.
What's at stake for providers?
All of this raises questions about the IaaS panel's future.
A DIA spokesperson told Reseller News the current IaaS panel contracts finish in 2026 and the department was working with agencies and the industry to understand what was now needed.
"The nature of the services will change to reflect agency needs," the spokesperson said. "We expect future IaaS to sit alongside public cloud services on Marketplace. IaaS will remain an important option for agencies where cloud may not be appropriate.”
Analysis from Gartner Group last year indicated Spark NZ had the most skin in the IaaS game with 30.6 per cent NZ overall NZ market share, followed by AWS with 28.3 per cent. Microsoft claimed 16.8 per cent, Datacom 13.5 per cent and Google rounded out the top five with 4.5 per cent.
However Spark's cloud unit has been under pressure.
In February the telco reported a 4.5 per cent decline in revenue in its cloud business to $214 million as a "mixshift" towards public cloud and away from private cloud continued.
This resulted in a "repricing" of private cloud, presumably downwards, that impacted margins.
Spark Business Group unit CCL has delivered cloud services to government agencies and public sector organisations for many years, Spark said. It also partnered with leading public cloud providers including Microsoft and Amazon Web Services, as well as leading technology infrastructure providers.
"Industry estimates indicate that around a third of government IT infrastructure is currently in the cloud, and that this could double by 2030," Spark said.
"On that basis, providers such as CCL, with its locally owned and operated data centres, will continue to play a significant role, while we also work closely with the public cloud providers to deliver value to our customers using the services they provide – today and in the future."
Spark said it worked closely with customers to determine the best cloud strategy for them and to select the right platform or platforms to help them achieve their business objectives.
"Research tells us that 79 per cent of organisations prefer a hybrid cloud approach, which is using a combination of private and public cloud platforms to deliver their outcomes," Spark said.
"In helping our customers make any technology selection, we also consider other factors, such as performance, cost, and compliance with local laws, regulations, governance structures, and security standards."
A Datacom spokesperson said the company was always an advocate for organisations embracing the cloud and supported customers with a hybrid model where they could choose private or public cloud or a mix of both to meet their needs.
"While we don’t have much more to add in terms of comment, we know the technology landscape and needs in the government space are constantly evolving and therefore it makes sense for us – and government – to continually assess the best way to deliver services to Aotearoa," the spokesperson said.
local cloud 'ideally positioned'
Don Christie, managing director of Catalyst IT, said the IaaS policy change brought further credibility to Catalyst Cloud's local offering.
"As the only locally owned cloud provider with an AoG cloud framework agreement it confirms we are ideally positioned to host up to restricted levels of government data with zero jurisdictional risks whatsoever," he said.
Catalyst offers an open source cloud built on Open Stack which was "born hyperscale" out of a collaboration between NASA and the CERN Large Hadron Collider projects in the mid-2000s, Christie said.
Since then, Open Stack had been used across Europe and the USA for massive scale processing.
"With our recent GPUaaS product we are able to bring scale, machine learning (AI), price certainty across multiple regions with the advantages that being a local provider brings – not least of which being that our technologists live, breath and pay their taxes here in Aotearoa."