All you need to know about public cloud services

Overview of public cloud services

The status of system operations in public sectors

The operation of systems in the public sector has been individually established by central government, local governments, and public institutions in their own data centers or computer rooms based on their respective needs. The important systems of the central government are currently integrated into the NIRS (formerly Government Integrated Data Center) and are managed under cloud services. However, the rest of the systems are scattered across the country and are operated separately. The efforts to introduce the cloud into public information systems have been promoted by the NIRS of the Ministry of the Interior and Safety (MOIS), centering on the central government system. It started with the building of the G-Cloud system (2011) and the transition to the government cloud computing center (2013).

The challenges of cloud transformation in the public sector

Yet, with a total scale of 15,000 units, it was not easy to migrate systems that were scattered across the country to the cloud. The lack of an integration strategy and the interests of the relevant organizations slowed the progress. Also, due to the disparity between government’s one-time product procurement system and the cloud’s pay-as-you-go model, cloud adoption faced difficulties. This is very similar to the situation private companies faced during the early days of cloud transition.

Growing demand for cloud transformation

However, the necessity of cloud transformation in public information systems is quickly emerging with the recent wave of private cloud adoption, the introduction of new technology services, such as AI, and the need to expand emergency systems and secure flexibility due to COVID-19. Let's take a look at the government’s roadmap for public cloud transition and what preparations are required for private cloud providers to provide public cloud services.

What is a public cloud?

A public cloud can be defined as an infrastructure where government, local authorities, and public institutions operate public information systems.

What are the types of public information systems?

First, we will go over the types of public information systems and users. Korea's public information system can be broadly divided into two categories. First, there are closed internal systems, such as intranets, and business systems used by civil servants in internal administration and public networks. Second, there is a national service system, such as issuing certificates, paying taxes, and scheduling vaccinations, that we can encounter in our daily lives. Users of the public system are divided into public users and national users, and as of the end of 2020, 3.14 million (1.31 million civil servants, 440,000 quasi-public servants, and 1.57 million public institutions) national users refer to the entire nation. The scale of the system is 15,365 in total, 1,667 by the central government, 8,392 by local governments, and 5,310 by public institutions.

Public businesses and information systems as of the end of 2020

1) (2021) All Public Information System in One (alio.go.kr)
2) (2020) Government Organizational Management Information System (org.go.kr)
3) ('21.7.27) MOIS policy resource “Plan for administrative/public organization information resource cloud migration and integration”

Government's roadmap for public cloud

Today, government policies are shifting from “cloud-first” to “private cloud-first” policies. Government institutions used to prefer the NIRS's self-operated cloud center and the self-built public cloud, and they were hesitant to use private clouds due to security issues.

Institutions and information for private cloud use

※ Systems of private clouds that are not allowed
① An information system that processes information related to important national interests, such as secrets related to national security, national safety, national defense, unification, diplomacy, and commerce.
② An information system that processes information related to investigations and trials, such as criminal investigations, trials in progress, execution of sentences, and security measures.
③ An information system for processing the internal affairs of administrative institutions.
※ Source: MOIS policy resource "Guidelines for the Use of Private Clouds by Administrative and Public Institutions"

Now, the government is promoting a policy to prioritize the activation of private clouds by supplementing laws and systems and clearly dividing the service range at self-operated public institutions and centers using private clouds. The government’s basis for using private clouds is the “Guidelines for the Use of Private Cloud by Administrative and Public Institutions,” which was enacted in July 2016 and has been revised several times to define the scope of systems where private clouds are applicable as shown in the table below.

Five-year roadmap of public sector cloud migration

At the end of 2020, a total investigation of information systems of administrative and public institutions was carried out through the “ISP Project for Migration and Integration of Cloud Centers for Information Systems of Administrative and Public Institutions.” As a result, a plan has been established with the goal of 100% cloud migration for the next five years (2021–2025) with the following migration plan: The plan is to migrate 10,009 out of the 15,369 information systems built and operated for all administrative and public institutions to the cloud over the next five years. The rest of the 5,360 systems are systems that require onsite installation or are not applicable to the cloud due to the nature of the next-generation systems (i.e., local tax, local finance, etc.) and the move-in of the Daegu Center. The migration is divided into a public cloud and a private cloud, depending on the nature of the information system. The following chart shows the five-year cloud migration plan.

Cloud migration plan for administrative and public institutions’ information system

※ Source: (’21.7.27) MOIS policy resource “Plan for administrative/public organization information resource cloud migration and integration”

Status and plans of public cloud data centers

Public cloud – Public institutions’ self-built and operated cloud centers

So far, there are two public cloud data centers designated by the MOIS: The Daejeon Center and the Gwangju Center of the NIRS. The head of the administrative institution will review the installation and operation of the data center in order to integrate and manage critical information systems, such as national security, investigation, trial, and internal affairs. In addition to this process, the Minister of the Interior and Safety will designate additional public cloud centers. They will be designated among the data centers that are self-built and operated by the existing administrative and public institutions. The local governments will also designate the public cloud centers by considering the readiness of local information integration centers. Meanwhile, the public institutions postponed the designation in 2021 considering the public institution systems migrating to the newly opened Daegu Center of National Information Resources Service (2022). Instead, they will designate them in 2022 upon reviewing the insufficient space.

Public cloud data center deployment plan by institution type

※ Source: ('21.7.27) MOIS policy resource “Plan for administrative/public organization information resource cloud migration and integration”

The concept and requirements of private (public) cloud centers

Private (Public) Cloud – Public dedicated cloud centers provided by private cloud providers

For private cloud providers to provide public cloud services, they need to acquire CSAP certification and digital service certification. The providers must establish an independent service environment for public use and obtain the certificates for service levels, such as security and availability, required by the public. The CSAP certificate mainly assesses the security suitability for public cloud services. Furthermore, digital service certification evaluates whether the supply system of cloud services, including security measures, is in place. When the providers acquire the digital service certification, they can supply their cloud through a private or catalog contract with administrative and public institutions. The following are details of the CSAP authentication and digital service authentication

What is Cloud Security Assurance Program (CSAP)?

Conducted by Korea Internet & Security Agency, this evaluation and certification are mandatory for Cloud Service Providers (CSPs) aiming to offer cloud services in the public sector. The assessment evaluates service suitability through sector-specific evaluations of IaaS, PaaS, SaaS, and DaaS.

Digital service professional contract system

In the past, when providing cloud services to public institutions, the available contracts were limited to general competitive bidding contracts, such as individual contracts or labor cost contracts. Essentially, there was an absence of a system or framework for supplying product-as-a-service. After the legal revision on October 1, 2020, it became possible to contract product-as-a-service through the Digital Service Support System (https://www.digitalmarket.kr).
※ Product-as-a-service: pay-as-you-go product based on usage

What does digital service certification evaluate?

Digital service certification comprehensively evaluates the service provider's supply and operational capabilities, as well as the security of the three following types of services.

① Cloud computing service
② Services supporting cloud computing services
③ Convergence service: Cloud computing + intelligent information technology and service

Once the certification is acquired, government and public institutions can enter into private contracts or catalog contracts through a system with private cloud service providers for the certified services.

Cloud service CSAP security certification scope

4) Infrastructure as a Service (IaaS), 5) Platform as a Service (PaaS), 6) Software as a Service (SaaS), 7) Desktop as a Service (DaaS)
※ Source: Cloud security certification system of Korea Internet & Security Agency

Before and after the revision: Cloud computing act, national contract law, business procurement act

※ Source: Digital service use support system (digitalmarket.kr)

Certified public cloud service providers and usage procedures

Private cloud providers certified for public cloud services: In alphabetical order

※ Source: Digital service use support system (digitalmarket.kr)

Procedure for utilizing the digital service utilization support system

※ Source: Digital service use support system (digitalmarket.kr)

Providers capable of providing public cloud services (IaaS)

The certifications for the provision of public cloud services are based on the certifications of the IaaS sector. Public cloud services, such as PaaS, SaaS, and DaaS must be serviced on the cloud of CSAP-certified IaaS providers. As of the second half of 2021, there are nine CSAP certification companies and six digital service certification companies in the cloud service (IaaS) sector, and Samsung SDS public cloud has acquired both CSAP certification (Aug 2019) and digital service certification (Mar 2021).

Closing remarks: The prospect of introducing public cloud services

Cloud adoption in the public sector is poised to accelerate due to factors such as the widespread use of cloud services, demand for cutting-edge 4th industrial revolution technologies, and the flexibility need in cloud-based systems due to COVID-19. A public cloud is similar to a country's backbone infrastructure, such as electricity, communication, and roads. In this sense, the public cloud not only provides a base environment for the public information system as the core digital infrastructure of the Korean government, but also plays a role as a facilitator for the development of domestic private cloud service industry.

In the future, we hope that the private cloud providers will grow together with public cloud services in line with the government's cloud policies and become a good example of public-private cooperation that can lay the foundation for the global competitiveness of domestic native cloud services.