APPLICATION OF CLOUD TECHNOLOGIES IN THE PUBLIC SECTOR AND THE SESU OF UKRAINE

Abstract

The article analyses the legal regime, service models and approaches to risk assessment of cloud technologies in the public sector of Ukraine, with particular reference to the State Emergency Service of Ukraine (SESU). The methodological foundation rests on regulatory-legal, comparative and risk-oriented approaches. On the basis of the Law of Ukraine “On Cloud Services” and subordinate legislation, the terminology has been systematised, the roles of the parties and the requirements for providers defined. The Ukrainian classification of cloud services, specifically SECaaS and the “collective cloud,” has been compared with the NIST approach to service models and cloud infrastructure characteristics. Separate attention is given to the risk-oriented approach in evaluating cloud solutions for public users, drawing on ISO/IEC 27005, NIST SP 800-30 and cloud security assurance practices (CSA CCM). Acceptability criteria for cloud solutions in the public sector have been identified: lawfulness of data processing, compliance with established provider requirements, incident control, auditability, continuity of service provision and minimization of single-vendor dependency. It has been concluded that the adoption of cloud technologies in Ukraine’s public sector is taking place within the framework of an established legal regime that combines legislative definitions, specific rules for government users, and a risk-based approach to the activities of providers.