Data Classification Matrix and Cloud Assessment Framework ; Cloud Assessment Framework and Evaluation Methodology

This data classification matrix and cloud assessment framework supports the policy goals articulated in the World Bank’s Institutional and procurement practice note for cloud computing services in the public sector. The framework is intended to support World Bank client countries, practitioners, and multilateral and bilateral development partners to manage the risks of acquiring public cloud solutions. These suggestions are based on good practices identified in the practice note. The framework first offers a data classification scheme for government data and personally identifiable information (PII) of citizens that governments and their contractors handle based upon the confidentiality, integrity, and availability security objectives. The framework then suggests cloud security requirements corresponding to each proposed data classification level. These security requirements are based upon international standards and good practices identified in the practice note. The framework also offers a checklist for procuring agencies seeking to procure cloud services.