ShareAndGoShareAndGo

Government

What New Zealand government agencies ask suppliers about cloud services.

If your business supplies a government agency, or hopes to, sooner or later a questionnaire arrives asking where your systems run, how information is protected and which services sit overseas. For a small firm, that can feel like a test written for someone else.

It helps to understand where those questions come from. New Zealand's public service works within a published cloud policy, a security manual and guidance on the risks of using services hosted in other countries. This article summarises what the Department of Internal Affairs and the GCSB publish, what that means for a supplier, and how to answer honestly. It explains published policy. It is not advice on any particular contract, which you should take up with the agency and your own advisers.

The Cloud First policy

The Department of Internal Affairs, through its digital.govt.nz guidance, states that government organisations must use public cloud services, when possible, for information systems. The digital.govt.nz list of Cabinet papers on cloud adoption runs back to 2012, and the policy was refreshed in April 2023.

The April 2023 Cabinet paper proposing that refresh sets out what agencies are expected to do. Among other things, they are to make adoption decisions on a case-by-case basis following a risk assessment, have a plan for how they intend to use public cloud services, and only store information classified as RESTRICTED or below in a public cloud service. The same paper sets a preference that, over time, agencies host RESTRICTED information in a New Zealand based data centre where a suitable service is available.

That preference matters for suppliers in a particular way. It is not a blanket rule that every service an agency touches must run in New Zealand. It is an expectation that agencies weigh where information sits as part of a wider risk assessment, with the classification of the information driving how much weight it gets.

Classification comes first

Government information is classified, and the classification shapes what tools can be used for it. Information at RESTRICTED or below can go into public cloud services after a risk assessment, according to the Cabinet paper. Higher classifications cannot go into public cloud at all.

So the first question to ask an agency is not about your systems. It is about the information: what classification will the documents you handle carry? A supplier sharing tender responses, invoices and project schedules is in a very different position from one handling sensitive case files. Getting the classification on the table early saves both sides from answering questions that do not apply.

Jurisdictional risk, in plain terms

The digital.govt.nz guidance on cloud services includes material on jurisdictional risk, meaning the risk that comes from information being held or processed under another country's laws. Agencies are encouraged to consider how governments in the places a service operates can lawfully access data held, processed or transmitted there, as one part of their overall assessment.

For a supplier, the useful response is a clear map of your own services. Which systems hold the agency's information? Where is each one operated? Which supporting services, such as sign-in, email delivery and payments, run in other countries? Agencies are generally better served by an accurate list with gaps admitted than by a reassuring answer that turns out to be incomplete.

The security manual

The GCSB publishes the New Zealand Information Security Manual, which agencies use for technical security requirements and which includes a section on using cloud services. Suppliers are not usually asked to meet it line by line, but an agency's questions will often be drawn from it, so reading the relevant section helps you anticipate what you will be asked.

Preparing honest answers

  1. List every system that will hold or process the agency's information, and where each is operated.
  2. List the supporting services that run elsewhere, such as sign-in, email and payments.
  3. Describe who can access the information, how they sign in and whether two-step verification is on.
  4. Describe what is recorded about access and how long those records are kept.
  5. Describe what happens to the information when the contract ends: how it is returned and how it is deleted.

If you use a data room to exchange documents with an agency, its controls answer several of these directly. In ShareAndGo, each person is invited to a named email address and confirms it with a six-digit code. Groups see only the folders they are allowed to. For view-only recipients, documents are rendered on our side with a watermark naming the viewer. Every view, upload, download and change is recorded in a chained audit log that exports as a CSV. At the end of a contract you can export the room with its folder structure and an index, then delete it, which removes the stored files and their previews.

Where the agency asks where documents are held, give the exact answer, including the overseas services, and let the agency make its own assessment.

Questions people ask

Do government agencies only accept suppliers who use local data centres?
Not as a blanket rule. The Cloud First policy asks agencies to assess risk case by case, limits public cloud to information classified RESTRICTED or below, and prefers New Zealand based data centres for RESTRICTED information over time where a suitable service exists. Each agency makes its own assessment.
Where does ShareAndGo keep documents?
Your documents are stored in Sydney, Australia.
What should I ask the agency first?
Ask what classification the information you will handle carries. It decides which questions apply and how much weight the agency will give to where your services run.

Keep reading

Where your data lives, and why New Zealand businesses ask

How the Privacy Act treats overseas storage and cloud providers, and what you stay responsible for.

How New Zealand SMEs should evaluate data room vendors

A practical way to assess vendors for a small team, without paying for features you will never use.

Privacy policy

What we collect, why, where documents are kept, and the services that run overseas.