MeitY plans migrating from NIC to secure cloud solution for government email services

The Ministry of Electronics and Information Technology (MeitY) is considering a migration from the National Informatics Centre's email solution, where nearly 33 lakh government employees are registered, to a secure cloud service that offers a range of office productivity tools. This means that in the coming days, government email services may no longer be hosted by the government itself.

The current NICNET e-mail service, which hosts government email addresses ending in @nic.in and @gov.in, is distributed across many mail servers located at various NIC Centres.

The ministry is looking for a master system integrator (MSI) who can take 'complete ownership' of migrating the email solutions to a cloud system that can be scaled, can handle up to 50 lakh users, has a robust cyber security mechanism, cloud security, and so on.

Also read: Govt aims to tap private players for IT support as personnel shortage hits NIC

As per an Indian Express report, six companies including Larsen & Toubro, Infosys, Softline, Zoho, Railtel and Rediffmail have been shortlisted as per the tendering process.

Simultaneously, pilot projects are already underway in MeitY to test the efficacy of email services by private players. They include Zoho, Microsoft and Rediffmail, an official had said earlier.

However, another source said that Microsoft was ruled out of this pilot due to compliance related reasons. Microsoft and Zoho had declined to comment when Moneycontrol reached out to the companies in April.

This is a part of a larger effort by the ministry to restructure the National Informatics Centre, which has been struggling due to a severe lack of funds and personnel. The government issued a tender last year to find a consultant to oversee the restructuring of this body under MeitY.

What the RFP says

In a request for proposal (RFP) issued to select such MSI, the government stated that the email solution should be hosted on MeitY-empanelled cloud service providers with data centres and disaster recovery centres in India.

"No email data sharing/replication to any data centre outside the boundaries of the country," the RFP said, adding that the MSI will have to submit documentation to prove the same.

Migrating govt emails

Digital India Corporation, the body that floated the tender, reasoned the need for migrating the emails "to empower these users with different set of office productivity tools such as word processor, spreadsheets, presentation tools and so on, along with collaboration tools and services such as video conferencing, chat, etc. based on their roles and function."

Moneycontrol reached out to a MeitY official, who declined to comment on the matter.

The master system integrator will be tasked with migrating emails from the existing email solution to the new cloud-based system in a seamless manner. This will involve creating a detailed project plan, designing and implementing the plan, and ultimately carrying out the migration.

The proposed email services would be required to have storage capacities of up to 100 GB, 100 GB for personal file storage, video conferencing with at least 100 participants, etc.

On the security front, MeitY wants to put in place measures that will aid in data loss prevention, protection from malicious URLs in emails, protection from malicious attachments in emails, encryption, and so on.

The entire architecture will undergo several rounds of testing, including load testing, security testing, and user acceptance testing by the email service provider, NIC, or any other third-party auditor.

Compliance heavy

"The email solution should comply with standards (ISO 27001:2013, ISO 22301:2019, ISO 20000-1:2018, etc.) and regulations as notified by Government of India from time-to-time including but not limited to (IT Act 2000 and its subsequent amendments…" the RFP said.

"MSI and email service provider need to ensure that offered solution as part of project scope and ensuing policies and procedures to have strict compliance to all cyber/information security policies, procedures and regulation and its subsequent updates issued by Govt. of India or its authorized agencies during the entire project duration)," it added.