The government's cloud-first policy was introduced in 2013. Since its launch, further documents have been published to support and build on the policy. This has continued under the current Labour government, which has also released additional material in support of the approach

What is cloud computing?

Cloud computing is a way of delivering computing services, such as data storage, applications, and processing power, over the internet instead of relying on personal or on-site hardware. This allows individuals and organisations to access the resources they need without purchasing or maintaining physical infrastructure themselves.

There are three main types of cloud computing services commonly used. The first is software as a service, or SaaS, which allows users to access and use software applications over the internet, typically through a web browser, without needing to install or manage them locally. The second is platform as a service, or PaaS, which provides a cloud-based environment that developers can use to build, test, and deploy applications, removing the need to manage the underlying hardware and software layers. The third is infrastructure as a service, or IaaS, which offers virtualised computing infrastructure such as servers, storage, and networking components, allowing users to run applications and manage workloads on demand via the cloud.  

What are the benefits?

Cloud computing allows you to treat core IT resources, such as computing power, network capacity, storage, and energy usage, as utilities. These resources can be accessed and scaled on demand, rather than being purchased and maintained upfront. As you move further along the cloud computing model toward software as a service (SaaS), the benefits increase, offering more value and efficiency across your operations.

One of the key advantages is the ability to focus more time and effort on developing services that directly benefit your users, instead of being tied up with the ongoing management of physical infrastructure or datacentres. This shift not only reduces the operational burden but also frees up internal resources for innovation and service delivery.

Cloud computing also removes the need for large upfront capital investments in infrastructure. Instead, organisations can take advantage of scalable, pay-as-you-go pricing models. This helps reduce overall costs while still giving access to enterprise-grade infrastructure and performance.    

Another benefit is the increased flexibility that comes with cloud-based services. It becomes easier and more affordable to experiment with new services, trial different approaches, or make adjustments to meet changing needs, without being locked into long-term infrastructure decisions.

Environmental sustainability is also supported through cloud adoption. By using cloud providers that operate highly efficient datacentres, you can reduce your organisation’s carbon footprint and align with the UK government’s Greening Government strategy. These providers typically optimise their use of power and physical server space far more effectively than traditional, on-premise solutions.

Security is another area where cloud services can offer improvements. Cloud providers regularly update their infrastructure with the latest technology, apply critical security patches promptly, and manage the security of the layers they are responsible for. This helps ensure a stronger baseline of protection compared to many in-house setups.    

With the cloud, services are typically designed to be more resilient and highly available. This means improved reliability for users and better continuity during unexpected disruptions. In addition, access to cloud-based services can help attract and retain skilled digital professionals, offering your teams better tools and support.    

Finally, cloud computing supports a more agile approach to planning and continuous improvement. With easier access to data, tools, and scalable infrastructure, your organisation can iterate and evolve more effectively to meet the needs of users and respond to emerging challenges.

Choosing cloud as a government organisation

When procuring or renewing services, it is mandatory for all government organisations to first consider and thoroughly evaluate potential cloud solutions before exploring any other options. This requirement ensures that the government maximises the benefits of cloud technology, such as scalability, cost efficiency, and flexibility, while adhering to best practices for digital transformation.

To help guide your decision-making process, you can refer to detailed guidance on migrating to and using cloud services in the public sector. This guidance provides essential information on how to effectively adopt cloud computing, ensuring that you make informed choices about the right services for your organisation’s specific needs. The aim is to streamline the transition and optimise the use of cloud technologies within the public sector.

When choosing the most suitable cloud computing service for your organisation, there are several key factors to consider. First, it is essential to continually revalidate your cloud hosting strategy to ensure it remains aligned with the evolving needs of your organisation. Cloud services and technologies are constantly changing, so periodic reviews are critical to maintaining a robust and future-proof strategy.

You must also take into account your existing legacy technology. Some systems may not be fully compatible with certain cloud platforms, or they might require additional work to integrate effectively. Evaluating these legacy systems and understanding how they will work within a cloud environment is crucial to making a seamless transition.

Lastly, it is important to assess the hosting business case. This involves evaluating the financial implications, including cost comparisons, potential savings, and any other economic considerations of moving to the cloud. A clear, well-founded business case will help justify the decision and ensure that the shift to cloud computing delivers long-term value to your organisation.  

What to consider when migrating

When deciding how and what to migrate to the public cloud, there are several important factors to consider in order to ensure a successful transition. First and foremost, you must be fully aware of government policies and guidance related to offshoring and data residency. These regulations are critical, as they dictate where and how your data can be stored and processed, ensuring compliance with legal and security standards.

Security is another key consideration. It’s essential to verify that your chosen cloud solution provides the appropriate level of security for your organisation’s needs. This includes ensuring that data protection measures are in place, such as encryption and access control, and that the cloud provider follows industry standards and regulations to safeguard your sensitive information.

Selecting a multidisciplinary team is also vital. To effectively navigate the complexities of cloud migration, it’s important to assemble a team that includes expertise in commercial, technical, and service delivery areas. This collaborative approach will help ensure that all aspects of the migration process are considered, from cost and contracts to technical compatibility and end-user support.

Another important factor to weigh is vendor lock-in. You should consider the amount of lock-in you are willing to accept when choosing a cloud provider, and how you can manage technical dependencies in the cloud environment. Vendor lock-in occurs when it becomes difficult to move services or data between providers due to proprietary technologies or formats, and managing this risk can provide greater long-term flexibility.

Finally, ensuring that your staff have the necessary training to both implement and use cloud computing is crucial for the success of the migration. Ongoing training and development will empower your team to effectively manage the new cloud environment, make the most of cloud tools, and stay up to date with evolving technologies and practices.

Cloud-First

When procuring either new or existing services, public sector organisations are expected to prioritise the use of public cloud solutions as the default option. This “cloud-first” approach reflects the government’s broader strategy to modernise digital infrastructure, improve efficiency, and deliver better value for public services. While this requirement is mandatory for central government departments, it is also strongly recommended for the wider public sector, including local authorities, health bodies, and other public institutions.

Using public cloud services by default helps organisations take advantage of scalable infrastructure, flexible pricing, and the latest technology without the burden of maintaining physical hardware. It supports innovation and responsiveness while enabling faster and more cost-effective delivery of digital services.

However, in cases where deploying services in the public cloud is not feasible, whether due to specific technical, regulatory, or operational constraints, organisations must be able to clearly justify their decision. This includes documenting the rationale for choosing an alternative solution, presenting a strong business case, and demonstrating that the chosen approach offers value for money when compared to public cloud options.

Government Cloud principles

Public sector organisations are expected to follow the Government Cloud Principles when planning, designing, and delivering digital services. These principles are designed to help strike a careful balance between delivering technology at pace, managing cost and resource requirements, and minimising risk. By adhering to these guidelines, organisations can make more informed decisions, support innovation, and maintain strong governance over their cloud strategies.

One of the core principles is to focus on services, not servers. This means using higher-level cloud services, such as managed platforms and tools, to deliver business value quickly. These services should be resilient, performant, secure, and easily recoverable, allowing teams to focus on outcomes rather than managing infrastructure.

Organisations should adopt a Public Cloud or Software as a Service (SaaS) first approach wherever possible. If public cloud or SaaS solutions are not viable, then private cloud options, including Platform as a Service (PaaS) or Infrastructure as a Service (IaaS), may be considered. In all cases, infrastructure should be provisioned and managed using infrastructure-as-code to ensure consistency, repeatability, and agility.

Where private cloud is used, it must meet the five essential characteristics of cloud computing: on-demand, broad network access, resource pooling, rapid elasticity and measured service. These features are critical to achieving the flexibility and efficiency that cloud computing offers. Additionally, organisations should assess whether the private cloud solution provides adequate security benefits and aligns with good cloud practices.

In cases where hosting services on-premises is unavoidable, the use of Crown Hosting is strongly recommended. Crown Hosting offers a solution specifically designed for government needs, providing a streamlined procurement process and reducing the overhead of traditional hosting arrangements.

Teams should also be supported in using cloud services that are hosted overseas or globally, provided that due diligence is carried out. This includes following guidance from the Information Commissioner’s Office (ICO) and the National Cyber Security Centre (NCSC) to ensure compliance with data protection and security requirements.

Support code is to be reused in the Cloud by aligning Cloud configuration, Landing Zones and hosting architectures across the public sector.

Security must be embedded by design, in line with the NCSC’s security principles. Systems and services should be protected from the outset and maintained to agreed standards, ensuring resilience against evolving threats.

Organisations should also apply best commercial practices when procuring cloud services. This includes leveraging vendor relationships established by Crown Commercial Service through frameworks and Memorandums of Understanding (MoUs). Taking advantage of collective buying power helps ensure better pricing, improved terms, and reduced procurement overhead across government.

Finally, each time a new service or feature is developed, teams should review all available vendors and cloud services to determine the most suitable solution for the task. This approach encourages competition, drives innovation, and ensures that vendors are incentivised to continuously improve their offerings.

G-Cloud

The G-Cloud framework helps the public sector achieve the cloud-first policy by making it easier, faster, and more transparent to find and procure cloud-based services. It removes many of the traditional barriers to cloud adoption and directly supports the government’s ambition to prioritise cloud solutions for public sector technology needs.

One of the key benefits of G-Cloud is that it simplifies the procurement process. It provides access to a wide range of pre-approved cloud suppliers and services through the Digital Marketplace, allowing organisations to avoid complex and time-consuming tendering processes. This supports quicker decision-making and enables faster delivery of digital services, in line with the cloud-first approach.

G-Cloud is structured around cloud service models such as Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). This helps ensure that public cloud and ready-to-use services are prioritised over more traditional or bespoke solutions. By encouraging scalable, flexible service models, the framework makes it easier for organisations to adopt modern, cloud-native tools that meet their needs.

The framework also supports better value for money and transparency. Because suppliers publish detailed information about their services, terms, and pricing, public sector buyers can compare options more easily and choose the most appropriate and cost-effective solution. This visibility promotes competition and helps drive down costs.

Risk is also reduced when using G-Cloud, as all suppliers go through a vetting process that includes checks on their security practices, data handling, and service capabilities. This provides a level of assurance for buyers and is especially valuable for organisations with limited in-house expertise in cloud procurement or management.

By using G-Cloud, organisations can also ensure compliance with government policies and standards, including those around data protection, security, and sustainability. This makes it easier to adopt cloud services while remaining aligned with regulatory and strategic requirements. Finally, G-Cloud opens up access to a wide range of suppliers, including many small and medium-sized enterprises (SMEs). This increases the diversity of providers and gives public sector organisations access to more innovative, agile solutions, rather than relying solely on large legacy vendors. In doing so, the framework supports a more competitive and dynamic cloud services market across government.