The Global Centre for Risk and Innovation (GCRI)
Many public digital systems run on commercial cloud platforms or a few national data centres. This brings scale and capability, and it creates dependence on a small number of providers, questions of jurisdiction over data, and shared points of failure. This page sets out how hosting choices shape the risk of public digital infrastructure, how concentration is measured, and what evidence serves the governments and regulators who make these choices.
GCRI · In development · service level R0
Public sector cloud is the hosting of government systems and data on commercial or national cloud platforms. It brings scale, but concentrates many services on few providers, raises questions of jurisdiction over sensitive data, makes exit costly and creates shared points of failure.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India; each layer is a dated NASA product.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 2
Connected activity
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Public cloud and concentration · Payment switch · Today
| Identity verify | 138 | 0.8 | Normal |
| Instant payment | 567 | 0.4 | Normal |
| Data exchange | 365 | 1.1 | Degraded |
| Offline fallback | n/a | n/a | Standby |
Vendor dependency and continuity. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Cloud markets are concentrated, so many public services depend on the same providers and regions.
Foreign providers may be subject to laws that compel data access, raising sovereignty concerns for sensitive public data.
Proprietary services and data transfer costs make it difficult to move systems between providers or back in-house.
An outage or compromise at one provider or region can disrupt many public services at once.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Sovereign cloud | Cloud services designed to keep data and operations under a particular jurisdiction's control. |
| Vendor lock-in | Dependence on one provider that makes switching costly or slow. |
| Egress fee | A charge for transferring data out of a cloud provider's network. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Public workloads by hosting type | percent of workloads | per assessment | Government inventories | DECLARED |
| Share of public cloud spend with the largest provider | percent | annual | Procurement data | OBSERVED |
| Critical systems with tested exit plans | percent | per assessment | Exit plan records | REPORTED |
| Sensitive data hosted under domestic jurisdiction | percent of sensitive datasets | per assessment | Data classification records | DECLARED |
| Provider outages affecting public services | count and hours | annual | Incident records | OBSERVED |
| Sovereign cloud offerings available | count | per assessment | Market review | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Government cloud strategies and procurement frameworks | Policies and contracts for public cloud | Public records, licence per government |
| Competition authority cloud market studies | Market concentration and switching barriers | Public records, licence per authority |
| Public procurement data portals | Spending by supplier | Open data, licence per portal |
| EU Data Act provisions on cloud switching | Rules on switching and egress charges | Public, EU terms |
| Provider status histories | Records of outages | Public, terms per provider |
Digital Public Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Government digital and procurement agencies | Where to host which systems and under what terms | Dependency maps; exit assessments |
| Competition and data regulators | Whether concentration or transfers need intervention | Concentration and jurisdiction evidence |
| Security agencies | Which data must stay under domestic control | Data classification reviews |
Public services must continue regardless of the commercial fortunes or policy choices of any one supplier. When many government functions depend on the same provider, a technical failure, contract dispute, price change or legal order affecting that provider can disrupt services across the state. Concentration also affects bargaining power and the state's ability to change course.
Concentration risk has technical, commercial and legal dimensions.
Outages at a major provider affect all services hosted there. Architecture across regions or providers can reduce but not remove this risk.
Proprietary services and data formats make migration costly. Pricing and terms can change after dependency has grown.
Providers are subject to the laws of the countries where they are based and operate, which may conflict.
The most common weakness is not the choice of cloud but the absence of a tested way out. Exit plans that exist only on paper, data held in formats only one provider can read and skills concentrated in a supplier's staff all leave the state dependent. Building portability in from the start is cheaper than recovering it under pressure.
Registers of providers behind public services. Often incomplete, especially for software components.
Practical tests of migration and data return. Rarely carried out, so exit plans are often untested.
Review of continuity, data and exit clauses. Standard terms may give governments little leverage.
Assessment of designs for portability and resilience, applying high-performance, cloud and edge computing.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.