📌 Part 5 of the FA-Objection Field Guide
This is a deep-dive on a single objection. Read the pillar guide on all 8 FA objections →
What the FA is actually asking
The literal question: "Where will it be hosted?" The FA's real concerns:
- Has the right hosting model been chosen for the right reason?
- Is the cost defensible across the contract life (often 5 years)?
- Is data residency compliance documented?
- If the vendor disappears, is the hosting transferable?
- Is there a DR plan and is it costed?
Why thin responses fail
The most common failure: "AWS / Azure / GCP — pay-as-you-go." The FA flags it because:
- Pay-as-you-go is unbounded cost; no AMC discipline
- Data-residency claim depends on which AWS region — needs explicit citation
- If the vendor's AWS account holds the deployment, exit is non-trivial
- No DR plan attached
The next most common: blindly choosing NIC because "it's the safe default". Sometimes correct, often not. NIC has capacity constraints, queue times of 4–18 months for new modules, and limits on what stack can be deployed. A blind NIC choice without a fit assessment is procedurally weak.
The shape of a holding response
Part 1 — Hosting decision matrix
Score each option against the project's actual requirements:
| Option | Data classification fit | Capacity / queue | Latency to citizen | 5-yr TCO | DR maturity | Exit portability |
|---|---|---|---|---|---|---|
| NIC Cloud (MeghRaj) | ✓ default for confidential | 4–18 mo queue | Good (in-country) | Low | Standard NIC DR | Within NIC ecosystem |
| NICSI co-located | ✓ confidential | 2–6 mo | Good | Low–medium | NIC DR optional | Easier than MeghRaj |
| AWS GCC (India) | ✓ DPDP-compliant region | Hours | Excellent | Higher (variable) | Excellent | Vendor-dependent |
| Azure Govt Cloud | ✓ specific PSU certifications | Hours | Excellent | Higher | Excellent | Vendor-dependent |
| GCP India | ✓ DPDP-compliant region | Hours | Excellent | Higher | Excellent | Vendor-dependent |
| On-prem (department DC) | ✓ for highest classification | Capex + setup | Excellent | High capex / lower opex | Department-built | Full control |
| Hybrid (on-prem + cloud burst) | Configurable | Hybrid | Excellent | Most flexible | Configurable | Configurable |
Part 2 — Capacity-planning document
Usage assumptions made explicit. Peak concurrent users, peak transactions per second, storage growth per quarter, file-upload bandwidth, query-per-second on the database. The FA can sanity-check these against your department's actual user base.
Part 3 — AMC clause with locked rates
Hosting AMC locked at agreed rates for at least 3 years. No "market-linked" clauses. If using public cloud, the vendor (or the cloud reseller) commits to a quarterly cost ceiling; overages need pre-approval.
Part 4 — Migration-portability annexure
Documentation that lets the department leave the chosen provider without a rewrite:
- Data export in open standard formats (Postgres dump, SQL standard, CSV, JSON)
- Infrastructure-as-Code that runs on any cloud (Terraform with multi-provider modules)
- Container-based deployment (Docker images that run anywhere)
- Tested migration runbook (vendor demonstrates migration to a parallel provider during contract)
The legal anchors
- DPDP Act 2023 — data fiduciary obligations, cross-border data transfer rules
- MeitY policies on government cloud — preference framework for NIC/MeghRaj
- CERT-In Direction April 2022 — log retention 180 days; applies to your hosting
- Sectoral classification rules — RBI for banking PSUs, IRDAI for insurance, MeitY for government
- National Data Sharing & Accessibility Policy
- GFR Rule 230 — long-term contracts and AMC provisions
Typical FA pushback patterns
- "Why not NIC by default?" — answer with the decision matrix; cite NIC capacity queue or stack-fit gap
- "What is the 5-year cost ceiling?" — pre-attach the locked-rate AMC clause
- "Where exactly does the data live?" — name the AWS/Azure/GCP region and cite its DPDP compliance
- "What if the vendor's cloud account is the only access?" — answer: department's own account; vendor manages, doesn't own
- "Has DR been tested?" — pre-schedule annual DR drill in the contract
What we hand you
- A completed hosting decision matrix for your specific project
- A capacity-planning document with usage assumptions
- A 5-year TCO comparison across the top 3 options
- An AMC clause with locked rates
- A migration-portability annexure for your contract
- A DR plan with annual-drill commitment
- A data-classification + DPDP-compliance memo for the file
Big Helpers Procurement Concierge — included with every government engagement
We draft your noting with the right GFR + DFPR citations, pre-build the answers to all 8 FA objections, structure your file to CVC + CAG audit standards, attend the FA review with you if needed, and stay through the contract handover. Net effect: typical procurement timeline shrinks from 4 months to 2–3 weeks. No charge — included with engagement.
Get a tailored response template for your file
WhatsApp Kashvi with your project type + file stage · 24-hour response · No commitment
💬 WhatsApp Kashvi See Govt/PSU programme →Read the rest of the FA-Objection Field Guide
- The pillar — all 8 FA objections at a glance
- 1. Cost reasonableness — defending the price tag
- 2. Single-vendor / Rule 161 nomination — the 70% kill zone
- 3. IPR transfer & source-code escrow — owning what you bought
- 4. Scope creep & cost overrun — the change-control protocol
- 5. Hosting — on-prem vs NIC vs cloud vs hybrid
- 6. Exit terms & vendor lock-in — the 14-clause exit annexure
- 7. "Why not NIC / NICSI / CDAC?" — the comparison done right
- 8. MSME / GeM / Make-in-India preference — the screen note