Cloud & Infrastructure
MeitY Empanelled Cloud Service Providers: Buyer's Guide
Affix Center · · 9 min read
Quick answer: MeitY empanelled cloud service providers are companies whose specific cloud offerings have been audited by STQC and listed by the Ministry of Electronics and Information Technology for government use. Departments and PSUs should check the exact offering, deployment model and Indian data centre regions covered, then buy through approved routes such as GeM.
A department signs up with a well-known cloud brand, moves its portal, and then an audit remark arrives: the region or service used is not part of the empanelled offering. Or procurement stalls because nobody can show which list the provider was chosen from. These problems are common, and they are avoidable.
The rules around MeitY empanelled cloud service providers are not complicated, but they are often misread. Teams assume any large cloud brand qualifies, or that empanelment covers every service a provider sells. This guide explains what empanelment means, how the deployment models compare, what to check, and a step-by-step way to choose and migrate.
What MeitY Empanelment Means
Under the Government of India's cloud initiative, known as GI Cloud or MeghRaj, the Ministry of Electronics and Information Technology (MeitY) empanels cloud service offerings for use by government organisations. A provider applies, and its offering is audited by STQC (the Standardisation Testing and Quality Certification Directorate) against MeitY's technical and security requirements. Only offerings that pass are empanelled.
The key point is that empanelment is for a specific cloud service offering, often tied to particular data centre regions in India. It is not a blanket approval of everything a company sells. Before you commit, check that the exact services and regions you plan to use are covered by the current empanelment, and keep a copy of that evidence on file.
Empanelled offerings are also expected to keep government data in India. Our guide to data localisation requirements for cloud in India explains this in more detail.
Deployment Models Compared
MeitY empanelment covers different deployment models. Match the model to the sensitivity of your application, not to price alone.
| Model | How it works | Typical use | Trade-off |
|---|---|---|---|
| Public cloud | Shared infrastructure with logical separation between tenants | Citizen portals, information websites, apps with variable traffic | Lowest isolation of the three |
| Virtual private cloud | Isolated section of the cloud with stronger network controls | Applications handling personal data or internal processes | More design and network work |
| Government community cloud | Infrastructure dedicated to government users only | Workloads needing higher isolation | Fewer providers and services to choose from |
Your department's data classification and guidance from your IT or security wing should decide the model. If you are weighing cloud against your own data centre, our article on hybrid cloud vs private cloud covers the wider choice.
Common Mistakes With MeitY Empanelled Cloud Service Providers
Most problems in government cloud projects come from planning gaps rather than technology:
- Assuming the brand is enough. A provider may be empanelled for one offering or region but not another. Record the exact empanelled offering in your file notes and contract.
- Lifting and shifting without cleanup. Moving an old, unpatched server to the cloud moves its weaknesses too.
- Leaving everything open. Databases and admin panels exposed to the internet are a frequent cause of incidents.
- No cost ownership. Without monthly review, test servers and old snapshots keep running and billing.
- No one on call. Cloud does not remove the need for operations. Someone must respond to alerts, apply patches and handle backups.
- Weak documentation. Without network diagrams, access lists and runbooks, knowledge leaves when staff or vendors change.
Each of these is fixed by the same habit: write down decisions, owners and evidence at every stage, and review them before each major change such as a new portal launch or an annual peak season.
Key Requirements to Check Before Choosing
Go beyond the empanelment list and check the practical details:
| Check | What to confirm |
|---|---|
| Empanelment scope | The exact offering, services and Indian regions you will use are covered |
| Data location | Data, backups and disaster recovery copies stay in Indian data centres |
| Security controls | Encryption at rest and in transit, identity and access management, logging, firewall options |
| Service levels | Uptime commitments, support response times and penalties |
| Exit terms | How you get your data back, in what format and within what time |
| Billing clarity | How compute, storage, bandwidth and backup are charged |
| Managed services | Who sets up, patches, monitors and backs up your workloads |
Procurement Basics for Government Buyers
Government organisations must follow their procurement rules, and cloud is no exception:
- Use approved channels. Cloud services from empanelled providers can be procured through the Government e-Marketplace (GeM). Check your department's rules for thresholds and approvals. Our guide to procuring IT services on GeM covers the process.
- Size before you buy. Estimate compute, storage and bandwidth from current usage and expected growth. Oversizing wastes money; undersizing hurts citizens during peak demand.
- Separate cloud and managed services. The provider supplies infrastructure. Someone still needs to run your workloads. Put that in scope.
- Define responsibilities in writing. Cloud security is shared. The provider secures the platform; you remain responsible for operating systems, applications, user access and data.
How to Compare Two Empanelled Offerings
Once you know several providers qualify, empanelment stops being the deciding factor. The choice then comes down to fit. Score each shortlisted offering on the same points:
- Service fit. Does the offering include the managed database, backup, load balancing and security services your application needs, or will your team build them on plain virtual machines?
- Region and disaster recovery. Are there at least two empanelled Indian regions, so you can keep a disaster recovery copy in a different city?
- Skills and support. Does your team or partner already know this platform? Retraining adds time and risk. Check how support tickets are raised and in what language and hours.
- Total cost over three years. Compare compute, storage, data transfer, backup and support together, including expected growth, not just the first month's estimate.
- Exit path. How easily can you move virtual machines, databases and files out if a future tender picks another provider?
Write the scores down and attach them to your file noting. It gives auditors a clear record of why one offering was chosen over another, and it protects officers if the decision is questioned later. It also helps when the contract comes up for renewal, because you can see quickly whether the original reasons still hold.
How to Solve It: Choose and Migrate Step by Step
- Inventory your applications. List every application, database, integration and dependency, with its owner and the data each one holds.
- Classify data and pick the deployment model. Use your data classification to choose between public cloud, virtual private cloud and government community cloud.
- Verify the empanelled offering. Confirm that the provider's exact services and Indian regions you need are covered by current MeitY empanelment and keep the evidence on file.
- Procure through an approved route. Buy through GeM or your department's approved process, with cloud and managed services clearly scoped.
- Design the landing zone. Set up networks, access roles, logging, backup policies and security baselines before moving any application.
- Get the application audited. Government applications typically need a security audit by a CERT-In empanelled auditor before going live, so plan it into the timeline.
- Migrate, test and keep logs. Move data, run parallel testing, and retain ICT system logs for 180 days within Indian jurisdiction as the CERT-In Directions of April 2022 require.
- Set up monitoring, backups and cost review. Configure alerts, test a restore from backup before retiring the old server, and assign one officer to review usage every month.
For the audit step, see our guide to CERT-In empanelled security audits. For a wider task list, our cloud migration checklist also applies to public sector moves.
Frequently Asked Questions
What are MeitY empanelled cloud service providers?
They are providers whose specific cloud service offerings have been audited by STQC and empanelled by MeitY for use by government organisations in India.
Does empanelment cover all services of a provider?
No. Empanelment applies to specific offerings and often specific Indian regions. Check the current empanelment details for the exact services you plan to use.
Where can I find the list of empanelled providers?
MeitY publishes empanelment details for cloud service offerings on its official website. Always check the current list, as empanelments are updated over time, rather than relying on old documents or vendor slides.
Can a PSU or municipal body use a non-empanelled cloud?
Government organisations are generally expected to use MeitY empanelled offerings. Check your department's policy and any directions from your state IT department before choosing.
Is the cloud provider responsible for application security?
No. The provider secures the platform. Your team or partner must secure the application, operating system, user access and data.
How Affix Center Can Help
We help government bodies, PSUs and enterprises plan and run cloud workloads on MeitY empanelled offerings. Our cloud and infrastructure team can assess your applications, size the environment, design a secure landing zone, support migration and manage the setup afterwards, while our e-governance team helps portals run faster and cheaper once they move. Get in touch for a practical assessment.