Sovereign cloud for India: Building trusted digital infrastructure for the AI era

Ministries and departments can use common decision trees, workload examples, approval workflows, exception handling and minimum control baselines to support consistent implementation

Provider claims and contractual commitments need to be supported by evidence, with standard evidence packs, independent assessments, recurring control testing and continuous monitoring. Controls should extend across backups, replicas, logs, snapshots, retired media and object stores, with appropriate lifecycle, sanitisation, deletion and validation practices

RFPs and contracts need to address legal operators, subcontractors, privileged access, locations of data, compute, metadata, logs and backups, disclosure requests, incident notification, continuity, portability and exit support

AI introduces additional considerations around compute access, training-data lineage, model artefacts, inference location, monitoring, human oversight and fallback arrangements