Record STMT-WA5E9FBLegally binding

Cloud First Policy

Institutional policy Institutional policyMiddle East · BHadoptedNot AI-specific

The Cloud First Policy sets out a mandatory guiding framework for Bahraini government ministries and agencies to adopt cloud computing solutions as the primary delivery model for information and communication technology (ICT) procurement. It aims to reduce costs, increase security, improve productivity, and enhance citizen services by leveraging standardized, accredited cloud infrastructure. The policy outlines service and deployment models, security principles, data classification, and the specific roles of government entities, the Information and eGovernment Authority (iGA), and governance committees.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

Supreme Council for Information and Communication TechnologyGovernment · BH

Lead issuer

Information and eGovernment AuthorityRegulator · BH

Publisher

Legal forceLegally binding

Under whose authorityInstitutional policy

Judged fromfull text

Who it governs

National governmentRegulatorsPublic sector bodies

ICT leadership and procurement officers within Bahraini government ministries and agencies who plan, procure, or manage IT infrastructure and cloud services.

Sectors

Public administration · government ICT and cloud services procurementTelecommunications and digital services · cloud computing infrastructure

What the document contains

What's covered

The document addresses the strategic adoption of cloud computing across Bahraini government agencies, defining rules for application migration, cloud security, data classification, backup procedures, and institutional responsibilities.

What's missing

The text does not contain any mentions of artificial intelligence, machine learning, automated decision-making systems, or specific technical algorithms.

Key takeaways

All Bahraini government agencies must evaluate cloud-based services when undertaking ICT procurements.
The policy adopts NIST definitions for cloud computing characteristics, deployment models, and service models.
Cloud service providers must meet international security standards such as ISO 27001 and CSA certifications.
Government entities remain the owners and controllers of their data at all times.
The Information and eGovernment Authority (iGA) acts as the interface between cloud providers and government entities.

Principles it states

ICT at entity level must focus on functional excellence and delivering higher business value.ICT Infrastructure is one key candidate for national level consolidation and optimization.Standardized infrastructure management enables optimization of infrastructure cost, improvement in service quality, improved security, and efficient business continuity.Promote a holistic cloud-first approach while respecting local legislation and mandates.

Outline

· Definitions/Glossary
· Policy statement
· Entities Affected by this Policy
· Who Should Read this Policy
· Policy Principles
· Overview of Cloud Computing
· Detailed Purpose of Policy
· Operational Framework
· Roles and Responsibilities
· IGA Related Policies
· Related Procedures
· Related References

Issued24 April 2017

Length3,229 words

FormatNot recorded

Scopenational

How it scores

Pending review

Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.

Accountability

4/5

Clear responsibility for AI outcomes

It is the responsibility of each government agency to ensure that they have a mitigation and back-up plan for their data and services.

Mitigation and Back-Up

screening score · 2026-10-23

Fairness

0/5

Non-discrimination and equitable treatment

screening score · 2026-10-23

Human Dignity

0/5

Respect for the inherent worth of persons

screening score · 2026-10-23

Human Oversight

0/5

Humans remain in control of consequential decisions

screening score · 2026-10-23

Privacy

3/5

Protection of personal data and private life

Commercial cloud service providers should provide logical security audit on data access, including logs and audit trails to ensure the prescribed security and privacy requirements are met.

Security Framework

screening score · 2026-10-23

Transparency

2/5

Openness about how AI systems work and are used

Transparency of the utility-based pricing structure means that spending caps and alerts can be implemented to further assist in budget control.

Detailed Purpose of Policy

screening score · 2026-10-23

Enforcement

4/5

Consequences and compliance mechanisms with real force

ICTGC will audit the government entities for compliance at its discretion, at regular intervals as well as on an ad hoc basis.

Roles and Responsibilities - ICTGC

screening score · 2026-10-23

Impact Assessment

4/5

Required assessment of an AI system's risks/impacts before or during use

The decision on the appropriate ICT delivery model will be based on an assessment of each application, incorp orating fitment of purpose, cost benefit analysis and achieving value for money over the life of the investment.

Policy statement

screening score · 2026-10-23

Topics

Physical AI Governancesupporting

cloud_computing digital_government ict_procurement data_security public_administration