Cloud is becoming critical public infrastructure. How should government govern it?
In the private sector, the gap between cloud investment and business outcomes is described as a value-realisation problem. In government, that gap carries a far greater cost. It is experienced by a resident who cannot resolve a billing query, an official who struggles to access a critical system, a municipality that’s unable to collect revenue or a community waiting for a service to be restored.
By Nkuli Mbundu, Managing Executive: Public Sector, BCX
This is why the next public-sector cloud conversation must be about public value.
Cloud is already embedded in the machinery of the state. It supports financial management, revenue collection, citizen engagement, collaboration, records, service coordination and operational continuity. Whether every institution formally describes these environments as cloud is beside the point. Government depends on digital infrastructure to fulfil its mandate.
As that dependence grows, the governance conversation needs to evolve with it.
Roads, water systems and electricity networks are treated as strategic public assets because their failure has immediate consequences for communities. A platform that supports municipal billing, service requests, land-use applications or financial controls should be treated with the same seriousness. If a digital service determines whether government can collect, communicate, respond or recover, its performance is not merely an ICT matter. It is a matter of governance, institutional capacity and public trust.
The public-sector value gap
The mistake is to assume that moving a workload into a cloud environment creates value by itself. It does not. Cloud delivers the greatest value when the processes, data and accountability around it are considered as part of the transformation. Moving an existing service into a new environment does not, on its own, address the wider operational challenges that affect its effectiveness.
Public-sector cloud strategies should therefore begin with the mandate, not the platform.
What community outcome must improve? Which service journey supports it? How quickly must it recover after disruption? What must government retain control of? Who remains accountable when the operating model crosses several institutions and providers?
Only once those questions have been answered should the architecture be decided.
This is the public-sector expression of a workload-first cloud strategy: the right workload, in the right environment, with the right controls, for a defined public outcome. Some workloads may suit public cloud, while others require private, sovereign or tightly controlled environments. The model should follow data sensitivity, service criticality, resilience, cost and public accountability.
A provider can operate infrastructure, while government retains its mandate and accountability for the services and public information entrusted to it. This makes a clear partnership model, with well-defined roles and responsibilities, essential.
An election makes the relationship between digital infrastructure and public trust impossible to ignore. Distributed sites, common processes, cybersecurity, continuity and public communication must work as one trusted system. A technical failure can become a democratic concern because legitimacy depends on confidence in the systems supporting the process.
The same principle applies to government between elections. Residents won’t see the digital environment behind a municipal account, licensing service or fault-reporting platform, but they experience its reliability. When a service is unavailable or information cannot be traced, trust is weakened. Digital resilience is therefore part of institutional credibility.
Resilience must be designed before disruption
Across local government, critical workloads already span financial administration, revenue management, customer engagement, records management, infrastructure operations and municipal service delivery. The reality is that these environments are interconnected. A disruption in one area has cascading effects across multiple services.
Resilience must therefore be engineered across the entire service environment rather than within individual applications. Cloud governance succeeds when institutions understand and protect the operational relationships between systems, people, data and community outcomes.
Disaster recovery and cybersecurity cannot be technical workstreams added after migration. Before a critical public workload moves, leaders should know how long the institution can operate without it, which services must be restored first, where verified backups are held and who has authority during an incident. Recovery targets must reflect the public consequence of downtime, not only the technical characteristics of the system.
This matters across the municipal estate. A failure in a revenue platform interrupts collections and customer service. An unavailable records environment delays procurement, approvals and audit work. A disruption to land-use or building-control systems holds up investment and development. Loss of access to field-service systems slows restoration teams precisely when communities need them most.
Identity and access management, monitoring, third-party risk, incident response and recovery are therefore part of the service itself. Each connection between financial platforms, customer channels, field teams, contractors and infrastructure assets improves delivery, but it also expands exposure. The answer is not to avoid connection. It is to govern it deliberately.
Cost must be connected to purpose
Cloud creates flexibility, and clear ownership helps ensure that this flexibility translates into value. Financial and technology governance must therefore converge. Institutions need visibility into what they are consuming, which public outcomes that consumption supports and who is accountable for the spend. FinOps, observability and continuous optimisation are mechanisms for protecting public resources.
The strongest measure of cloud value is not the number of workloads migrated. It is whether revenue is better protected, services recover faster, officials have clearer operational visibility, auditability improves and communities experience less friction.
From platform to public outcome
A municipal financial platform such as BCX SOLAR illustrates the point. Its value is not confined to hosting or transaction processing. As a core platform supporting financial administration, revenue management and operational visibility, it enables municipalities to strengthen billing integrity, debt management, auditability and decision-making. Consolidated billing, debt-management capabilities and mSCOA-aligned reporting improve financial governance, while dashboards provide leaders with a more current view of organisational performance and service delivery risks.
The same outcome depends on capabilities that sit beyond the application. Municipal sites and service points need reliable access to the platform. Remote approvals and field teams need secure connectivity. Monitoring must provide visibility into performance and availability. Cybersecurity controls need to protect identities, transactions and data. Backup and recovery have to sustain continuity.
The public outcome depends on these capabilities being governed as one service rather than managed as separate technology workstreams.
This also broadens the role of the technology partner. Beyond migration, the opportunity is to work alongside government to manage cost, security, performance and recovery throughout the life of the workload while strengthening the institution’s own capability.
As cloud becomes an important part of public infrastructure, the opportunity is to ensure that its governance reflects the importance of the services it supports.
That means moving beyond technology modernisation in isolation. The real task is to build resilient digital foundations that protect continuity, strengthen institutional capability and create the conditions for services to connect across government.
When cloud is governed in this way, it stops being a technology destination. It becomes the resilient foundation on which connected services, capable institutions and better community outcomes can be built.









