Cloud First Policy | The State of Kuwait

The State of Kuwait has implemented a ‘Cloud First Policy’ to accelerate the adoption of cloud computing within its public sector. This initiative, led by the Communication and Information Technology Regulatory Authority (CITRA), mandates that government entities prioritise cloud services when acquiring new information and communications technology (ICT) solutions. The policy aims to enhance operational efficiency, reduce costs, and foster innovation across government services.

To support this policy, CITRA has established a comprehensive Cloud Computing Regulatory Framework. This framework outlines the requirements for cloud service providers (CSPs) operating in Kuwait, ensuring they meet specific standards for data security, privacy, and service quality. A key component of this framework is the Data Classification Policy, which categorises data into four levels based on sensitivity:

1. Level one: Non-classified data
   Public information such as policies, regulations, and forms available on official websites is not protected from disclosure.
2. Level two: Private insensitive data
   Data identifying the owner without infringing on privacy, including names, job titles, and email addresses.
3. Level three: Private sensitive data
   Personal data that, if disclosed without authorisation, could infringe on privacy, such as internal reports, medical records, and legal files.
4. Level four: Highly sensitive data
   Data that, if disclosed, could cause serious privacy infringements or national security issues, including encryption keys, sensitive political documents, and military information.

Under this policy, data classified as Level Three or Level Four must be stored within Kuwait’s borders and encrypted to ensure security. CSPs handling such data are required to obtain licenses from CITRA and establish local data centres. This approach ensures that sensitive information remains under national jurisdiction, aligning with Kuwait’s commitment to data sovereignty.

The Cloud First Policy not only streamlines government operations but also serves as a catalyst for broader digital transformation in Kuwait. By embracing cloud technologies, the government sets a precedent for private sector adoption, promoting a culture of innovation and technological advancement throughout the country.