DevOps for Public Sector & Digital Government

What regulates the infrastructure

What actually goes wrong here

• A single shared IT estate per authority means one ransomware event takes out every service at once — planning applications, social care case management, revenues and benefits, and the phone system — because a small council runs them on one domain with one supplier, unlike a large enterprise where blast radius is naturally segmented.
• No 24/7 operations capability at the scale most authorities run at: incidents that begin on a Friday evening are discovered on Monday morning, and mean time to detect is governed by staffing rosters rather than tooling.
• End-of-life software persists because replacing it needs a capital bid through a committee cycle, not an operational decision — so unsupported operating systems and databases stay in production for years past vendor support, with compensating controls as the only mitigation.
• Shared-service arrangements between neighbouring authorities create common-mode failure: consolidating several councils onto one platform for cost reasons means an outage now removes services from all of them simultaneously.
• Deadline-shaped demand with no relief valve. Results day, an enrolment window or a payment date puts a year's worth of concurrent sessions into a few hours, and unlike a retailer the authority cannot queue people until tomorrow or turn away the marginal user.
• Exit and data egress at contract end. Framework call-offs run for years with no funded exit plan, so migration off an incumbent stalls on data extraction and undocumented integrations — and under G-Cloud 15's eight-year hosting terms that lock-in window is now longer.

How demand behaves

Demand is low and flat for most of the year, then concentrated into date-certain administrative windows fixed by statute or the academic and fiscal calendar — enrolment days, results days, billing runs, payment dates. These peaks cannot be smoothed, deferred or load-shed, because the deadline is set in law and the citizen has no alternative supplier. Spending itself is also seasonal: annual appropriations mean procurement and project activity bunch at fiscal year-end.

Data you will be holding

Public sector bodies hold citizen identity, benefits, social care, education and council tax records — data subjects who cannot opt out or take their business elsewhere, which removes the usual market correction for poor handling. A second constraint is unusual to this sector: records are subject to freedom-of-information and public-records law, so mailboxes, case notes and even system logs may be disclosable and must remain retrievable and searchable for statutory retention periods, which shapes archiving and eDiscovery design as much as security does.

Architecture this pushes you toward

Public sector estates are typically a thin modern web front end over a much older system of record — benefits, revenues or student information systems that were not designed for interactive concurrency — so scaling the presentation tier simply moves the queue. Identity is the other structural feature: citizen-facing services increasingly federate to a national or regional identity provider, making that federation a single point of failure across otherwise unrelated services. Accessibility and FOI obligations push toward server-rendered, well-structured pages and long-lived, searchable archives rather than ephemeral client-side state.

Availability expectation

Availability is normally set in the individual call-off contract under a purchasing framework rather than by a sector-wide standard, with 99.9% common for citizen-facing transactional services and remedies expressed as service credits. In practice the binding target is often a fixed calendar date — being available on results day or payment day — rather than an annual percentage.