The National Archives’ cloud strategy

FOI request reference: CAS-68526-M5J0M3
Publication date: June 2021

Request

1. Do you have a cloud strategy? (Please provide a link to the strategy)
A) Yes
B) No

2. When was the cloud strategy defined?

3. If yes, what is the focus of your cloud strategy?
A) All in on public cloud (no private cloud or on premise infrastructure)
B) Cloud First (new services in public cloud with some on premises infrastructure or private cloud)
C) Hybrid cloud (some combination of one or more public clouds, private cloud and on-premises)
D) Private cloud (no public cloud)

4. What public cloud(s) do you use?
A) AWS
B) Alibaba Cloud
C) Azure
D) Google Cloud Platform
E) Oracle Cloud
F) UK Cloud

5. What percentage of your applications and/or workloads is on premise?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

6. What percentage of your applications and/or workloads is in the public cloud?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

7. What percentage of your data is on premise?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

8. What percentage of your data is in the public cloud?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

9. What percentage of your infrastructure is legacy?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

10. Do you have third-party services or solutions on premise that are not cloud-ready or fit for cloud migration?
A) Yes
B) No

11. What workloads or functions have you moved to the cloud? (Multiple answers. Please specify other if not listed)
A) Office productivity (e.g. Microsoft 365, Google Workspace)
B) Citizen-facing digital services (e.g. GOV.UK)
C) Back-office applications (e.g. transaction processing)
D) Artificial Intelligence, Machine Learning, cognitive services
E) Software development/DevOps
F) Corporate functions (e.g. HR, Finance, CRM)
G) Intranet
H) Public website
I) Backup, business continuity and disaster recovery
J) Other

12. What challenges did you face when moving to the public cloud? (Multiple answers. Please specify other if not listed)
A) Migrating certain applications
B) Legacy infrastructure
C) Different refresh cycles
D) Difficulty proving cost illustrations
E) Funding paths (Capex/Opex)
F) Data gravity
G) Data Classification
H) Licensing concerns
I) Data privacy concerns
J) Offshoring & data residency
K) Lack of in-house skills
L) Vendor lock-in/ Egress cost prohibitive
M) Other

13. What percentage of your infrastructure do you plan to be public cloud based in 12 months’ time?
F) 0%
G) 10%-25%
H) 25%-50%
I) 50%-75%
J) 100%

14. What percentage of your infrastructure do you plan to be public cloud based in three years’ time?
A) 0%
B) 10%-25%
C) 25%-50%
D) 50%-75%
E) 100%

15. How much has your organisation spent on public cloud since the Government’s G-Cloud or ‘cloud-first’ policy was introduced in 2012?

16. How much has your organisation spent on on-premise infrastructure since the Government’s G-Cloud or ‘cloud-first’ policy was introduced in 2012?

17. How much has your organisation spent on cloud/infrastructure consultancy services in FY 20-21?

18. How much was spent on public cloud data egress charges in FY 20-21?

Outcome

Information Provided

Response

Your request has been handled under the Freedom of Information (FOI) Act 2000. The FOI Act gives you the right to know whether we hold the information you want and to have it communicated to you, subject to any exemptions which may apply.

I can confirm that The National Archives holds some information relevant to your request. We are pleased to be able to provide this information to you.

We are unable to provide you with some of the information you have requested, however, because it is covered by the exemption at section 31 (1) (a) of the FOI Act, which exempts information if disclosure would prejudice the prevention or detection of crime.

Some of this information is also covered by the exemption at section 21 of the FOIA. This exempts information if information is readily available by other means.

Some of the information is also covered by the exemption at section 12 of the FOIA. This exempts information if the cost of compliance exceeds the appropriate limit.

For further information about why an exemption has been applied, please see the explanatory Annex at the end of this letter.

1) Do you have a cloud strategy? (Please provide a link to the strategy)

We do not have a specific Cloud Strategy, however, there is reference to cloud policy in our IT and Digital Services Strategies.

Information regarding our IT Strategy is contained in a previous FOI response and published on our website. Please use the following link to access our previous response:

ICT Documents – Freedom of Information (nationalarchives.gov.uk)

Information regarding our Digital Services Strategy is published on our website. Please see the below link for this:

Our digital strategy – Archives Inspire the world (nationalarchives.gov.uk)

2) When was the cloud strategy defined?

This information is covered by the exemption at section 21 of the FOIA.
Please see the links provided in Question 1.

3) If yes, what is the focus of your cloud strategy?
A) All in on public cloud (no private cloud or on premise infrastructure)
B) Cloud First (new services in public cloud with some on premises infrastructure or private cloud)
C) Hybrid cloud (some combination of one or more public clouds, private cloud and on-premises)
D) Private cloud (no public cloud)

This information is covered by the exemption at section 21 of the FOIA.

Please see the links provided in Question 1.

4) What public cloud(s) do you use?
A) AWS
B) Alibaba Cloud
C) Azure
D) Google Cloud Platform
E) Oracle Cloud
F) UK Cloud

Disclosing software systems, product names, vendors and versions may reveal information that would prejudice the prevention or detection of crime and is exempt under section 31 (1) (a) of the FOI Act.

5) What percentage of your applications and/or workloads is on premise?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

The National Archives does not hold this information

6) What percentage of your applications and/or workloads is in the public cloud?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

The National Archives does not hold this information

7) What percentage of your data is on premise?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

The National Archives does not hold this information

8) What percentage of your data is in the public cloud?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

The National Archives does not hold this information

9) What percentage of your infrastructure is legacy?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

The National Archives does not hold this information

10) Do you have third-party services or solutions on premise that are not cloud-ready or fit for cloud migration?

A) Yes

11) What workloads or functions have you moved to the cloud? (Multiple answers. Please specify other if not listed)

A) Office productivity (e.g. Microsoft 365, Google Workspace)
B) Citizen-facing digital services (e.g. GOV.UK)
C) Back-office applications (e.g. transaction processing)
D) Artificial Intelligence, Machine Learning, cognitive services
E) Software development/DevOps
F) Corporate functions (e.g. HR, Finance, CRM)
G) Intranet
H) Public website
I) Backup, business continuity and disaster recovery
J) Other

We have moved the following functions to the cloud.

A) Office productivity (e.g. Microsoft 365, Google Workspace)
B) Citizen-facing digital services (e.g. GOV.UK)
C) Back-office applications (e.g. transaction processing)
E) Software development/DevOps
F) Corporate functions (e.g. HR, Finance, CRM)
H) Public website
I) Backup, business continuity and disaster recovery

12) What challenges did you face when moving to the public cloud? (Multiple answers. Please specify other if not listed)

A) Migrating certain applications
B) Legacy infrastructure
C) Different refresh cycles
D) Difficulty proving cost illustrations
E) Funding paths (Capex/Opex)
F) Data gravity
G) Data Classification
H) Licensing concerns
I) Data privacy concerns
J) Offshoring & data residency
K) Lack of in-house skills
L) Vendor lock-in/ Egress cost prohibitive
M) Other

The following challenges were faced when moving to public cloud:
A) Migrating certain applications
B) Legacy infrastructure
K) Lack of in-house skills

Please note that this is not an exhaustive list but is a reflection of what we have on record

13) What percentage of your infrastructure do you plan to be public cloud based in 12 months’ time?
F) 0%
G) 10% – 25%
H) 25% – 50%
I) 50% – 75%
J) 100%

The National Archives does not hold this information

14) What percentage of your infrastructure do you plan to be public cloud based in three years’ time?
A) 0%
B) 10% – 25%
C) 25% – 50%
D) 50% – 75%
E) 100%

The National Archives does not hold this information

15) How much has your organisation spent on public cloud since the Government’s G-Cloud or ‘cloud-first’ policy was introduced in 2012?

From our preliminary assessment, it is clear that we will not be able to answer your request because to do so would exceed the cost limit provision under section 12 of the Act. This exempts information if the cost of compliance exceeds the appropriate limit. Please see appendix for further details.
16) How much has your organisation spent on on premise infrastructure since the Government’s G-Cloud or ‘cloud-first’ policy was introduced in 2012?

From our preliminary assessment, it is clear that we will not be able to answer your request because to do so would exceed the cost limit provision under section 12 of the Act. This exempts information if the cost of compliance exceeds the appropriate limit. Please see appendix for further details.

17) How much has your organisation spent on cloud/infrastructure consultancy services in FY 20-21?
£168,000

18) How much was spent on public cloud data egress charges in FY 20-21?

£14,000 per annum

Please note that some aspects of this billing were charged in USD therefore the above spend is approximated based on currency exchange on the 3rd June 2021

If you are dissatisfied with the handling of your request or the decision which has been reached, you have the right to ask for an internal review. Internal review requests must be submitted within two months of the date of this response and should be addressed to:

Quality Manager
Programme Management Office
The National Archives
Kew
Richmond
Surrey
TW9 4DU
complaints@nationalarchives.gov.uk

Please mark your complaint clearly. You have the right to ask the Information Commissioner (ICO) to investigate any aspect of your complaint. However, please note that the ICO is likely to expect internal complaints procedures to have been exhausted before beginning her investigation.

Yours sincerely,

FOI Manager
Freedom of Information Centre
Government and Information Rights
The National Archives

EXPLANATORY ANNEX

Exemptions applied

Section 31: Law Enforcement
We are unable to provide you with information regarding software brands and specific contract start/end dates because this information is exempt from disclosure under section 31 (1) (a) of the FOI Act. Section 31 (1) (a) exempts information if its disclosure is likely to prejudice the prevention or detection of crime.

Section 31 is a qualified exemption and we are required to conduct a public interest test when applying any qualified exemption. This means that after it has been decided that the exemption is engaged, the public interest in releasing the information must be considered. If the public interest in disclosing the information outweighs the public interest in withholding it then the exemption does not apply and the information must be released. In the FOI Act there is a presumption that information should be released unless there are compelling reasons to withhold it.

The public interest has now been concluded and the balance of the public interest has been found to fall in favour of withholding information covered by the section 31 (1) (a) exemption. Considerations in favour of the release of the information included the principle that there is a public interest in transparency and accountability in disclosing information about government procedure and contracts.

However, release of this information would make The National Archives more vulnerable to crime. The crime in question here would be a malicious attack on The National Archives’ computer systems. As such release of this information would be seen to prejudice the prevention or detection of crime by making The National Archives’ computer system more vulnerable to hacking. There is an overwhelming public interest in keeping government computer systems secure which would be served by non-disclosure. This would outweigh any benefits of release. It has therefore been decided that the balance of the public interest lies clearly in favour of withholding the material on this occasion.

Further guidance on section 31 can be found here:
https://ico.org.uk/media/for-organisations/documents/1207/law-enforcement-foi-section-31.pdf  

Section 12 – Section 12 – Exemption where cost of compliance exceeds appropriate limit

Section 12 of the Freedom of Information Act 2000 (FOIA) makes provision for public authorities to refuse requests for information where the cost of dealing with them would exceed the appropriate limit, which for central government departments like The National Archives, is set at £600. This represents the estimated cost of one person spending just over three working days determining whether the department holds the information, as well as locating, retrieving and extracting the information.

We estimate that it will take us in excess of this to identify the appropriate information, and locate, retrieve and extract it in response to your request because it is so wide ranging. Therefore, the majority of your request will not be processed further.

You may wish to refine your request by narrowing its scope and being more specific about what information you particularly wish to obtain, including any dates or period of time relevant to the information required. For example, you may want to consider the following:

· Reducing the timescale to a single financial year within the past 5 years

You may find guidance produced by the ICO useful for this process: ‘How should I word my request to get the best result? ’ This provides some tips for making effective FOI requests, so that you can find the core information which is important to you.

To be clear, you are not obliged to inform us of the purpose of your request, but the more descriptive information you provide, the more we can help you identify if we hold the information you are looking for within the cost limit.

We are unable to guarantee that any refined requests would fall within the cost limit.

Section 21: Information readily available to the applicant by other means

Section 21 of the Freedom of Information Act 2000 (FOIA) does not oblige a public authority to provide information if it is already reasonably accessible by other means.

In this case the exemption applies because the information is already available

Information regarding our IT Strategy is contained in a previous FOI response and published on our website. Please use the following link to access our previous response:

[ARCHIVED CONTENT] ICT Documents – Freedom of Information (nationalarchives.gov.uk)

Information regarding our Digital Services Strategy is published on our website. Please see the below link for this:

Our digital strategy – Archives Inspire the world (nationalarchives.gov.uk)

Further guidance can be found at:

Information reasonably accessible to the applicant by other means (section 21) (ico.org.uk)