Public Cloud in State Administration: Enhancing Resilience & Continuity

I've recently had the opportunity to be part of projects with various state administration entities. And it’s clear the role of public cloud is significant from a security of supply perspective, especially when preparing for extreme contingencies, such as situations where an entire local data centre infrastructure is compromised.

The modern operating environment is filled with uncertainties that can jeopardise operations: Cyber-attacks, natural disasters, changes in geopolitical situations. So, preparedness and continuity management have become critical issues. And one key enabler that helps state organisations survive unexpected situations and maintain their operations is public cloud.

In this blog post, I’ll explain why public cloud is an excellent addition to preparedness and continuity management, plus how it supports state administration organisations in these tasks.

What do we mean by public cloud?

Basically, cloud services where the provider makes computing power, storage, and other resources available securely over the internet to multiple customers. They’re generally offered on a pay-as-you-go basis and can scale according to demand, provided by the likes of Amazon Web Services (AWS), Microsoft Azure and Google Cloud.

State administration organisations face unique challenges related to security, data protection and operational continuity. Public cloud can offer significant advantages here.

Scalability and flexibility

💡 Why?

One of the greatest advantages of the public cloud is its scalability. Organisations can easily increase or decrease resources according to their needs. This is particularly important in crisis situations where resource needs can change rapidly. Cloud services enable quick responses without the need for investments in new physical devices.

🔎 What are the challenges here?

The more an organisation has already transitioned to the cloud, the easier it is to plan the infrastructure for preparedness and outline additional requirements for the cloud. If an organisation is just beginning its cloud journey, a simulation of the cloud transition will be necessary as part of the preparedness planning, where basic aspects like cloud foundations, governance models, and cloud management policies need to be considered. Without this foundation, scalability can be uncontrolled, significantly increasing cloud costs.

Cost-effectiveness

💡 Why?

Using the cloud can be significantly more cost-effective compared to traditional IT. Organisations only pay for the resources they use, reducing the costs associated with purchasing and maintaining unnecessary resources.

🔎 What are the challenges here?

Building an actual cloud solution in the cloud as a one-time investment is relatively inexpensive in the context of preparedness costs. The major cost factors arise from maintaining the solution and, depending on the speed requirements for transitioning, ongoing capacity-related expenses. 

For instance, if the requirement is to transition to an emergency solution within hours, a continuously replicated solution with maintained and monitored integrations and dependencies is necessary. It’s essential to define a Recovery Time Objective (RTO) for critical systems, meaning the tighter the recovery time target, the higher the maintenance costs of the preparedness solution.

Rapid deployment and updates

💡 Why?

New services and updates can be deployed quickly in the cloud. This reduces downtime and ensures that organisations can leverage the latest technologies and security measures. Rapid deployment is crucial when quick changes are needed or when responding to new threats and challenges.

🔎 What are the challenges here?

In reality, preparedness often means transitioning a solution from a local data centre to the cloud during emergency conditions. This implies that the actual system or application continues its lifecycle within the current development model, and cloud capabilities cannot be applied to the existing solution. 

Various container technologies and genuine hybrid solutions allow the same technology to be used both in the local data centre and the cloud, but such an architectural choice must be made initially or requires changes to the existing application architecture.

Security and compliance

💡 Why?

State administration organisations must comply with strict security standards and requirements. Public cloud providers invest heavily in security and compliance, offering advanced security solutions such as encrypted data transfer and storage, as well as sophisticated monitoring tools. This helps state administration organisations meet legal requirements and protect citizen data.

🔎 What are the challenges here?

In state administration, there are many different regulations and criteria, which can be challenging for an individual organisation to interpret. The organisation must be able to weigh various residual risks that transitioning to the public cloud may entail. A positive aspect of the cloud transition includes clear guidelines published by the Finnish Ministry of Finance (or other similar local administrative office) that set specific constraints and controls for public clouds, ensuring a good level of security when transitioning to the cloud.

Rapid response in emergencies

💡 Why?

In emergencies such as natural disasters or cyber-attacks, state administration organisations must respond quickly. The public cloud allows for rapid scalability, meaning necessary resources can be added immediately during crises. This ensures that critical services remain operational, and citizens receive the necessary assistance and support.

🔎 What are the challenges here?

Balancing risk management is needed here. Should investments be made in a preparedness solution that will (hopefully) never be needed, or should minimal technical preparedness be implemented with a detailed plan for a possible transition to an emergency solution?

Collaboration and information sharing

💡 Why?

Organisations often need to collaborate with each other. The public cloud offers platforms and tools that facilitate this. Cloud-based document management and communication systems enable smooth and secure collaboration between different organisations, improving crisis management and decision-making.

🔎 What are the challenges here?

If a transition to emergency conditions is necessary, decision-making related to prioritisation will become paramount. Which function's continuity must be ensured first? In what order will systems be deployed, and how will the deployment be coordinated as a whole?

Resilience and disaster recovery

💡 Why?

Cloud providers offer built-in resilience and disaster recovery solutions. So, data can be replicated to multiple data centres in different geographical regions. This ensures that data and services are available even if one data centre encounters issues. Such features are expensive and complex to implement independently, but are often as-standard in the public cloud.

🔎 What are the challenges here?

However, the challenge is whether classified information, for instance, can be preemptively moved to the cloud? Or can the information only be moved once an emergency begins? Is it possible to enhance security levels in the cloud with certain technical controls and keep a backup system offline? 

These questions are crucial to consider during the definition phase of a preparedness solution. It’s essential to know your data and be able to highlight specific requirements related to the classification of this data.

Key takeaways

The public cloud offers significant advantages for organisations' preparedness and continuity management, the factors above making it an attractive option. 

But transitioning to the public cloud doesn’t remove the need to consider continuity management as a whole. This also means ensuring the availability of personnel during emergencies. And it requires an understanding of existing agreements with, for example, application or service providers. How can these critical stakeholders be engaged in a crisis? Another crucial cornerstone of continuity planning is a communication plan and decision-making processes.

Hopefully, an emergency preparedness solution is never needed, but it’s still worthwhile to consider the necessity of an additional preparedness capability and evaluate the cloud as one technical enabler. 

Organisations that leverage the public cloud can better prepare for future challenges and ensure the continuity of their operations. So it’s worth taking a step towards the future and ensuring organisational continuity and competitiveness by utilising the possibilities offered by the public cloud or at least exploring the benefits of the public cloud as part of preparedness.

Where can you turn if you need help here?

The Cloud Division of Digipooli is a Finnish national cooperative network focused on developing the security and reliability of cloud services. It supports the continuity of critical societal functions by providing expert assistance and coordination on issues related to the use of cloud services. More information about Digipooli can be found here. I represent Nordcloud in this network.

And at Nordcloud, we’re happy to assist with any topics related to the public cloud, including preparedness. We’re super experienced in working closely with state organisations, and offer deep expertise and experience in implementing cloud technologies, helping organisations to plan, migrate, manage, and optimise their cloud environments cost-effectively and securely.