PAKISTAN CLOUD FIRST POLICY The clients usually have the option to restrict their data to a particular geographic region. With no data residency requirement in place, the data belonging to GOP may be stored outside the boundaries of Pakistan and there is a possibility that GOP loses access to its data or the data may be subject to the laws of other countries. However, whenever there are legitimate use-cases requiring cross-border data flows, then the relevant stakeholders may consult with the Cloud Office to ensure appropriate security standards and controls are in place for such data flows. Policy Deliverables 9.1 Cloud Office A mandated and defined governance structure ensures smooth implementation and optimal operations of cloud services through a dedicated office(s). For the accelerated implementation of this policy, MoITT will set up a dedicated office to facilitate and supervise the matters connected thereto. This office will act as the flag bearer for cloud adoption in Pakistan and will define the criteria for the accreditation/registration of CSP according to domestic and international standards and support provinces in their cloud adoption efforts to bring uniformity in cloud adoption across Pakistan. GOP will ensure the implementation of this policy through Cloud Office(s). This planned governance structure will enable the roadmap for establishing a structured and formal organizational setup for cloud governance in Pakistan. Cloud Office is mandated to carry out the following functions i. ii. iii. iv. v. vi. Establish a classification, accreditation, registration and compliance framework for CSP based on international benchmarks. Carry out or seek compliance from the CSP against established benchmarks. Promote a cloud culture and adoption of cloud services across PSE. Provide a time-based No Objection Certificate (NOC) if there is a legitimate reason for deviation/exemption to PCFP. Enforcement of modalities for cloud first investments. Support provinces in adoption of cloud first policy in their jurisdictions. Annex-A: Cloud Service Models Annex-B: Priority of Cloud Service Models Annex-C: Share of Responsibility Page 9 of 21