The government has kicked off the search for a technology firm that will host its top secret information online as it shifts public sector systems away from fragmented physical server rooms and agency-owned data centres in a bid to cut maintenance costs.
Disclosures in the implementation guidelines of the 2025 Kenya Cloud Policy show the State has opened applications for interested providers to seek accreditation from a soon-to-be-established Cloud Adoption Committee (CAC).
A single provider, chosen from the accredited list, will host all State-held data and systems on its servers, with top secret data restricted to be held in a data centre within Kenya.
Storage of data and systems like e-Citizen on physical government servers has been banned, and all State organs have 24 months to migrate all systems to the cloud provider that the government will settle on.
This is part of a broader cloud-first policy primarily meant to cut State spending on purchasing, setting up and maintaining physical servers.
“Entities are prohibited from hosting systems, data, and applications in server rooms and entity-dedicated data centres except when authorised by the Cloud Adoption Committee (CAC),” reads the guidelines published by the Ministry of ICT and the Digital Economy.
“Migrate the non-exempted data and systems within 24 months. Entities are restricted from establishing new data centres unless approved by the CAC.”
According to the National Treasury, the government spends roughly Sh10 billion every year on data centres, servers, ICT services and infrastructure maintenance, an amount that will be significantly reduced if the services are collapsed and outsourced to a single vendor.
For instance, in the current financial year, the Treasury allocated Sh9.8 billion for ICT infrastructure, data centres, shared services and cybersecurity budgets for different State Departments and Agencies.
The shift to cloud services will create a new market for Kenyan cloud companies and data centre operators, although the exact list of providers eligible to host the most sensitive government workloads is yet to be published.
Under the new guidelines, State data will be grouped into three categories, depending on the level of sensitivity.
Top secret data, which is classified information guided by secrecy laws such as the Official Secrets Act and the Kenya Defence Forces Act, will be the most guarded and will require the cloud service provider to have a dedicated government server located in the country.
Restricted data is sensitive government information that is not legally secret but not meant for public consumption. This will be held by an accredited government cloud service provider (GCSP) with local presence.
Open data, which are intended for public use and transparency, will be hosted by an accredited provider but not necessarily within the country.
But having a data centre in Kenya does not automatically make a company eligible to host top secret government information.
The guidelines require providers seeking accreditation to demonstrate the physical location of their cloud and disaster-recovery infrastructure, disclose cloud partnerships, and provide evidence of certifications by the International Standards Organisation (ISO).
They must also demonstrate resilience, availability, backup capability and local technical support.
Safaricom, which recently launched its cloud services, could be a leading contender for the contract. The telco offers cloud services hosted in data centres in Nairobi and Kisumu, which it says offer data sovereignty and disaster-recovery benefits for Kenyans.
Konza data centre, which is fully State-owned, could also be a leading contender. It was allocated Sh175 million for expansion in the current financial year, and is set to be one of the largest data centres in the country.
Other local infrastructure is being built specifically around sovereign cloud requirements. iXAfrica Data Centres hosts Servernah Cloud. It also hosts Baobab Cloud, Paratus Cloud, and Zadara Sovereign Cloud.
These companies, however, will still need an assessment by the CAC to get GCSP status prequalifying them for the State cloud contract. Experts argue that currently, only one of the data centres in Kenya could host the State’s top secret data.
Michael Michie, a data scientist, AI engineer, and founder of AI firm EverseTech, argues that currently, only Konza can host top secret data as well as restricted and open, while Safaricom and Liquid Telecom’s Azure can host restricted, while the rest can only host open data.
“Government contract requirements may conflict with common cloud business models. Many cloud businesses depend on committed subscription fees and shared global support systems,” said Mr Michie.
“Re-engineering these arrangements for government procurement will be difficult. The required operating model is expensive. It is not merely an infrastructure requirement. It requires a mature service-management operation, incidence-response team, compliance function and field support staff.”
The policy also creates an opening for international cloud companies that establish or partner with local infrastructure. Oracle’s planned Kenya cloud region is currently listed by the company as “coming soon”, while Jeff Bezos’ Amazon Web Services (AWS) has established a Direct Connect location at East African Data Centres’ site near Nairobi.
Microsoft and G42 had announced a $1 billion investment programme, including a data centre in Kenya designed to run Microsoft Azure through a new East Africa Cloud Region.
The project was intended to provide local cloud capacity for government and other customers, but was cancelled after Kenya failed to provide guarantees for capacity uptake by neighbouring countries.
Kenya’s approach follows a model already used by governments that have sought to move away from ageing government infrastructure while retaining control over sensitive workloads.
Singapore, for example, began a five-year programme in 2018 to migrate most government IT systems from on-premise infrastructure to commercial cloud. The UK has similarly operated a Cloud First policy since 2013, requiring public sector organisations to consider public cloud before other options.
