Cloud infrastructure

1.) Please provide your organisation's total spend on cloud infrastructure for the last three financial years. (Please use the following categories) (£1M £1M - £2M £2M-£5M £5M-£10M )£10M

2022-2023

2023-2024

2024-2025

2.) Please list all of the hyperscaler cloud providers your organization currently uses: Amazon Web Services (AWS) Google Cloud Platform (GCP) Alibaba Cloud Microsoft Azure Oracle Cloud Infrastructure (OCI) Other……………………………………..

3.) Is your organisation considering using more than one cloud provider?

Yes - already doing this

Yes - under consideration

No

No, considering switching fully

Other

4.) Do you have any commercial agreements with any cloud providers?

If yes, please provide contract details (e.g. start/end date, amount, where you found the provider)

5.) Please list the internal departments with the highest utilisation of cloud services.

Corporate Services

Finance and Resources

Adult Social Care and Health

Children's Services and Education

Housing and Homelessness

Other

6.) What percentage of your organisation's data is currently hosted on cloud platforms versus on premises? <10% hosted on cloud platforms 10-25% hosted on cloud platforms 25-50% hosted on cloud platforms 50-75% hosted on cloud platforms 75-100% hosted on cloud platforms

7.) Have you implemented any policies regarding data sovereignty and/or cloud security? (If yes, please send a copy of any policies)

Yes

No

Other

8.) Please disclose any information your organisation holds relating to cyber incidents affecting your cloud systems. Ofcom/CMA Investigation:

Ofcom has raised concerns that some of the largest cloud providers (like Amazon AWS and Microsoft Azure) make it difficult or expensive for organisations to switch providers. This led to a formal investigation by the CMA, which is expected to publish its final findings by 4 August 2025.

9.) Is your organisation aware of the CMA investigation into major cloud providers and the concerns around switching costs, contracts, and competition?

Yes - fully aware

Somewhat aware

Not aware

Other

10.) Has your organisation taken any steps in response to this (for example, discussing risks of lock-in, reviewing contracts, or exploring alternative providers)?

Yes - formal review or actions taken

Yes - informal discussions only

No steps taken

Other

11.) What concerns, if any, do you have with your current hyperscaler cloud provider?

Cost

Security

Reliability (e.g., SLAs/customer care)

Vendor Lock-in

Geopolitics

Environmental concerns (e.g., water usage, power consumption, emissions)

No concerns

Other

I can confirm that the information requested is held by Lincolnshire County Council. I have detailed below the information that is being released to you.

1) 2022-2023 £1M-£2M

2023-2024 £1M-£2M

2024-2025 £1M-£2M

2) Microsoft Azure

3) No

4) In May 2018, under the Council’s EAS renewal with Microsoft, a decision was reached to make a monetary commitment to use M365 and Microsoft Azure cloud services.

5) Whilst cloud service consumption figures are available, we do not hold the information in this format, and do not review or analyse departmental usage of cloud services in that way.

6) 50-75% hosted on cloud platforms

7) https://www.lincolnshire.gov.uk/council-councillors/data-protection-policy/2

8) Please accept this as a refusal to disclose this information in accordance with Section 31(1)(a) and Section 31(3) of the Freedom of Information Act.

This exemption allows the Council to withhold information where is considers its disclosure under the Freedom of Information Act would be likely to prejudice the prevention or detection of crime.

This means it could be contributing towards a criminal activity which may not have taken place but for the disclosure of the information, therefore prejudice to law enforcement. Section 31 FOIA is subject to the public interest test.

We accept that there is a general presumption in favour of disclosure of information to provide accountability and transparency. The Council considers that the security of its systems and records is an overriding reason to not disclose the information and that there is a clear public interest in protecting data being held by the Council. We are satisfied that the reasons explained for maintaining the exemption at Section 31(1)(a) and Section 31(3) overrides the public interest in disclosing the information.

9) Yes - fully aware

10) Yes - informal discussions only

11) No current concerns. We review all aspects regularly, and take action where appropriate to issues that warrant attention