Government data in the cloud: Where is the line between efficiency and risk?

A year ago, on June 14, 2025, the Armenian government adopted a “Cloud First” policy aimed at transitioning government agencies from traditional server infrastructure to cloud-based data storage and processing. From the outset, the initiative sparked discussions about balancing cost efficiency with cybersecurity concerns. One year later, the topic once again became a subject of active debate during panel discussions held at the first Armenian defense industry exhibition RISE-2026, with NEWS.am Tech serving as the event’s information partner.

The Question Is Not the Cloud, but Where It Is Located

According to Komitas Stepanyan, Director of Information Technology and Cybersecurity at the Central Bank of Armenia, the key issue is where data is actually stored and who controls the underlying infrastructure. Stepanyan recommended paying attention to studies and publications by the World Economic Forum concerning major global cloud service providers and hyperscalers.

He noted that modern data centers rely on data replication mechanisms across multiple countries. As a result, even when a customer believes their data is stored within a specific jurisdiction, copies may in practice be located in other countries as well.

“When you place data in the cloud, you cannot always guarantee that it physically resides only in the country specified in the contract,” the expert noted.

As an example, he referred to recent military conflicts in the Middle East. Following attacks on data center facilities, major cloud providers reportedly began rapidly relocating servers and data between different sites. According to Stepanyan, in such situations end users often lose control over the actual physical location of their information.

In his view, this is precisely why issues of data storage, digital sovereignty, and control over critical infrastructure must remain at the center of attention for both government institutions and the private sector.

The Cloud Is Primarily About Architecture, Processes, and Risk Management

Nerses Yeritsyan, Chairman of the Information Systems Regulation Commission, offered a different perspective on the transition to a Cloud First model. He argued that the debate over “a server here or in the cloud” has become largely outdated, since government systems already operate in close connection with the internet environment.

According to Yeritsyan, even when data is stored locally, access to it is still mediated through external networks. Therefore, the key issue is not the physical storage location but how effectively governance, control, and cybersecurity processes are designed and managed.

He emphasized that adopting cloud solutions is fundamentally a transformation of mindset and digital architecture. Modern approaches, he said, are increasingly dominated by “Platform as a Service,” “Software as a Service,” and broader service-oriented models in which infrastructure becomes more flexible and scalable.

According to Yeritsyan, this allows governments to accelerate digital transformation, reduce implementation timelines from years to months, and respond more quickly to the needs of public institutions.

At the same time, he stressed that such speed requires a more mature and systematic approach to cybersecurity.

“If proper management processes are not in place, if there is no clear understanding of where data is located and how it is protected, vulnerabilities will emerge regardless of whether the system is cloud-based or local,” he noted.

He added that human error and the shortage of qualified professionals remain among the most significant risks.

Avoiding the Cloud May Be More Expensive

Deputy Minister of High-Tech Industry Gevorg Mantashyan noted that discussions around cloud adoption have long been accompanied by caution and, in some cases, outright warnings from experts and market participants.

According to him, recommendations were often made to reject cloud solutions altogether and continue investing exclusively in local infrastructure. However, Mantashyan argued that practical experience has shown such an approach does not always deliver the desired results and can, in fact, be more expensive and less flexible in terms of digital service development.

He pointed out that modern “Infrastructure as a Service” models have effectively become a global standard, and Armenia should focus on the most efficient and scalable solutions available.

At the same time, Mantashyan identified close cooperation between government, the professional community, and the private sector as a key factor for success, particularly when making strategic decisions related to digital transformation.

“If we move in a more economically justified and technologically advanced direction, while ensuring that the views of specialists and businesses are taken into account, the results will be sustainable,” he said.

He added that discussions on this agenda should continue, as the most balanced decisions are ultimately formed through dialogue.