Cloud Governance and Vendor Risk Management: A Case Study of Sri Lanka's NMRA Data Loss
DOI:
https://doi.org/10.31098/jgrcs.v6i2.4460Keywords:
Cloud Governance, Vendor Risk Management (VRM), Public Health Infrastructure, Digital Sovereignty, NMRA, COBIT 2019, ISO/IEC 27001, Design-Reality Gap.Abstract
Digital transformation improves operational efficiencies but poses several risks related to data sovereignty, vendor risk management (VRM), and information technology (IT) governance. The research paper focuses on the data loss case at the National Medicines Regulatory Authority (NMRA) in Sri Lanka. In this incident about two terabytes of pharmaceutical data became lost. The data included proprietary information and manufacturing approval of drugs obtained from the e-NMRA system in the Lanka Government Cloud. This evaluation of the technical problem is carried out against various Governance, Risk, and Compliance (GRC) models, including ISO/IEC 27001 and COBIT 2019. The analysis is also based on Heeks' design-reality gap (DRG) model, which allows us to establish the nature of deficiencies in sharing of responsibilities and disaster recovery plans within an institution. All these mentioned GRC models offer manay solutions to address governance problems and security risks. But, those GRC models operate assuming that organizations possess certain levels of institutional maturity and technical expertise. Unfortunately, this assumption does not always hold true. As a result, an empirical analysis of this case proves that there are serious problems with the management of data within government organizations in emerging digital economies. Therefore, this paper suggests creating a new framework: Sovereign Cloud Governance and Vendor Risk Management Model more suited for countries in this stage.
References
Al-Ansari, A. O., & Alsubait, T. M. (2022). Predicting cyber threats using machine learning for improving cyber supply chain security. In 2022 National Computing Colleges Conference (NCCC) (pp. 123–130). IEEE. https://doi.org/10.1109/NCCC57165.2022.10067692
AlGhamdi, S., Win, K. T., & Vlahu-Gjorgievska, E. (2020). Information security governance challenges and critical success factors: Systematic review. Computers & Security, 99, Article 102030. https://doi.org/10.1016/j.cose.2020.102030
Alharbi, F., Sabra, M. N. A., Alharbe, N., & Almajed, A. A. (2022). Towards a strategic IT GRC framework for healthcare organizations. International Journal of Advanced Computer Science and Applications, 13(1). https://doi.org/10.14569/ijacsa.2022.0130125
Auditor General's Department. (2021). Report of the Auditor General on the financial statements of the National Medicines Regulatory Authority for the year ended 31 December 2021. National Audit Office, Sri Lanka. https://www.naosl.gov.lk/web/images/audit-reports/upload/2021/state_corporation/2-xiii/National-Medicines-Regulatory-E.pdf
Auditor General's Department. (2023). Report of the Auditor General on the financial statements of the National Medicines Regulatory Authority for the year ended 31 December 2023. National Audit Office, Sri Lanka. http://www.auditorgeneral.gov.lk/web/images/audit-reports/upload/2023/State-Corporations/2-XXIII/National-Medicines-Regulatory-Authority---e.pdf
Bena, Y. A., Ibrahim, R., Mahmood, J., Talpur, N., Nasser, M., Ayemowa, M. O., & Yusuf, M. N. (2024). Harnessing and mitigating big data governance challenges using hybrid approach: A systematic literature review. IEEE Access, 12, 175151–175175. https://doi.org/10.1109/ACCESS.2024.3498947
Boyens, J., Smith, A., Bartol, N., Winkler, K., Holbrook, A., & Fallon, M. (2022). Cybersecurity supply chain risk management practices for systems and organizations (NIST Special Publication 800-161r1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-161r1
Cloud Security Alliance. (2024). Information technology governance, risk, and compliance in healthcare (Version 2). https://cloudsecurityalliance.org/artifacts/information-technology-governance-risk-and-compliance-in-healthcare-v2
Counterpoint. (2021). Deletion of data in the NMRA: Human error or a scam? Counterpoint Investigative Reporting. https://counterpoint.lk/deletion-data-nmra-human-error-scam/
Debreceny, R. S., & Gray, G. L. (2009). IT governance and process maturity: A field study. In 2009 42nd Hawaii International Conference on System Sciences (pp. 1–10). IEEE. https://doi.org/10.1109/HICSS.2009.278
Faruq, M. O. (2024). Vendor risk management in cloud-centric architectures: A systematic review of SOC 2, FedRAMP, and ISO 27001 practices. International Journal of Business Ecosystem & Strategy, 4(1), 1–32. https://doi.org/10.63125/j64vb122
Floridi, L. (2020). The fight for digital sovereignty: What it is, and why it matters, especially for the EU. Philosophy & Technology, 33(3), 369–378. https://doi.org/10.1007/s13347-020-00423-2
Gupta, D., Elluri, L., Jain, A., Moni, S. S., & Aslan, O. (2024). Blockchain-enhanced framework for secure third-party vendor risk management and vigilant security controls. In 2024 IEEE International Conference on Big Data (BigData) (pp. 5577–5584). https://doi.org/10.1109/BigData62323.2024.10825025
Heeks, R. (2003). Most eGovernment-for-development projects fail: How can risks be reduced? iGovernment Working Paper Series, University of Manchester. https://gsdrc.org/document-library/causes-of-e-government-success-and-failure-design-reality-gap-model/
Heeks, R. (2006). Health information systems: Failure, success and improvisation. International Journal of Medical Informatics, 75(2), 125–137. https://doi.org/10.1016/j.ijmedinf.2005.07.024
Information and Communication Technology Agency of Sri Lanka (ICTA). (2023). Sovereign cloud strategy Sri Lanka v0.4. https://www.icta.lk/icta-assets/uploads/2023/11/sovereign-cloud-strategy-sri-lanka-v0-4.pdf
Irion, K. (2012). Government cloud computing and national data sovereignty. Policy & Internet, 4(3–4), 40–71. https://ideas.repec.org/p/zbw/itse11/52197.html
ISACA. (2016). Vendor management: Using COBIT 5. Information Systems Audit and Control Association.
ISACA. (2019). COBIT 2019 framework: Governance and management objectives. Information Systems Audit and Control Association.
Leka, E. (2024). Exploring digital sovereignty through data flows: Empirical evidence from the backbone of the internet [Doctoral research presentation]. Toulouse School of Economics Postal Economics Conference / Institut Mines-Télécom Business School. https://www.tse-fr.eu/sites/default/files/TSE/documents/conf/2026/postal/leka.pdf
Lessa, L., Negash, S., & Belachew, M. (2016). Steering e-government projects from failure to success: Using design-reality gap analysis as a mid-implementation assessment tool. Electronic Journal of Information Systems in Developing Countries.
Makumbani, H., & Tsibolane, P. (2025). Design-reality gap analysis of health information systems failure. Procedia Computer Science, 256, 949–956. https://doi.org/10.1016/j.procs.2025.02.199
Malatji, M. (2023). Management of enterprise cyber security: A review of ISO/IEC 27001:2022. In 2023 International Conference on Cyber Management and Engineering (CyMaEn) (pp. 117–122). https://doi.org/10.1109/cymaen57228.2023.10051114
Mitchell, A. D., & Samlidis, T. (2021). Cloud services and government digital sovereignty in Australia and beyond. International Journal of Law and Information Technology, 29(4), 364–394. https://doi.org/10.1093/ijlit/eaac003
Nfuka, E. N., & Rusu, L. (2011). The effect of critical success factors on IT governance performance in public sector organizations in a developing country. Industrial Management & Data Systems, 111(9), 1418–1448. https://doi.org/10.1108/02635571111182773
Parliament of Sri Lanka. (2021). COPE objects to the unconstitutional decision taken by the Board of Directors of the National Medicines Regulatory Authority (NMRA). https://www.parliament.lk/en/home/parliament-news/view/3574
Parliament of Sri Lanka. (2024). COPE sub-committee to examine the National Medicines Regulatory Authority. Committee on Public Enterprises. https://www.parliament.lk/en/home/parliament-news/view/4452
Rambau, T. M., Munyoka, W., Phahlamohlaka, L. J., & Kadyamatimba, A. (2026). Evaluating cyber resilience frameworks for e-government: Applicability of NIST CSF, ISO/IEC 27001 and COBIT 2019 in developing country contexts. Information and Computer Security. https://doi.org/10.1108/ICS-09-2025-0376
Tamilarasi, R., Santhosh Kumar, P. N., Ghantasala, G. S. P., & Garg, S. (2024). Machine learning challenges of e-government models of cloud computing in developing countries. In 2024 11th International Conference on Computing for Sustainable Global Development (INDIACom). IEEE. https://ieeexplore.ieee.org/document/10498915
World Bank. (2022). Government migration to cloud ecosystems: Multiple options, significant benefits, manageable risks. World Bank Group. https://openknowledge.worldbank.org/items/7baff007-7bb9-4623-b229-b105cbf47284
Downloads
Published
Citation Check
How to Cite
Issue
Section
License
Copyright (c) 2026 Sahan Samarathunga, Anjula Handapangoda, Shehan Suraweera, Theekshani Hettiarachci, Madhushka Kumanayakage
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Content Licensing, Copyright, and Permissions
1. License
Journal of Governance Risk Management Compliance and Sustainability (JGRCS) has CC-BY NC or an equivalent license as the optimal license for the publication, distribution, use, and reuse of scholarly work for non-commercial purpose. The non-commercial use of the article will be governed by the Creative Commons Attribution license as currently displayed on Creative Commons Attribution-NonCommercial 4.0 International License
Creative Commons License
2. Author’s Warranties
The author warrants that the article is original, written by stated author(s), has not been published before, contains no unlawful statements, does not infringe the rights of others, is subject to copyright that is vested exclusively in the author and free of any third party rights, and that any necessary written permissions to quote from other sources have been obtained by the author(s).
3. User Rights
Journal of Governance Risk Management Compliance and Sustainability (JGRCS) objective is to disseminate articles published are as free as possible. Under the Creative Commons license, this journal permits users to copy, distribute, display, and perform the work for non-commercial purposes only. Users will also need to attribute authors and this journal on distributing works in the journal.
4. Rights of Authors
Authors retain the following rights:
Copyright, and proprietary rights relating to the article, such as patent rights,
The right to use the substance of the article in future own works, including lectures and books, The right to reproduce the article for own purposes, The right to self-archive the article, the right to enter into separate, additional contractual arrangements for the non-exclusive distribution of the article's published version (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal (Journal of Governance Risk Management Compliance and Sustainability).
The author has a non-exclusive publishing contract with a publisher and the work is published with a more restrictive license, the author retains all the rights to publish the work elsewhere, including commercially, because she/he is not subject to the conditions of her / his own license, regardless of the type of CC license chosen.
5. Co-Authorship
If the article was jointly prepared by other authors, the signatory of this form warrants that he/she has been authorized by all co-authors to sign this agreement on their behalf, and agrees to inform his/her co-authors of the terms of this agreement.
6. Termination
This agreement can be terminated by the author or Journal of Governance Risk Management Compliance and Sustainability (JGRCS) upon two months’ notice where the other party has materially breached this agreement and failed to remedy such breach within a month of being given the terminating party’s notice requesting such breach to be remedied. No breach or violation of this agreement will cause this agreement or any license granted in it to terminate automatically or affect the definition of Journal of Governance Risk Management Compliance and Sustainability (JGRCS).
7. Royalties
This agreement entitles the author to no royalties or other fees. To such extent as legally permissible, the author waives his or her right to collect royalties relative to the article in respect of any use of the article by This agreement can be terminated by the author or Journal of Governance Risk Management Compliance and Sustainability (JGRCS) upon two months’ notice where the other party has materially breached this agreement and failed to remedy such breach within a month of being given the terminating party’s notice requesting such breach to be remedied. No breach or violation of this agreement will cause this agreement or any license granted in it to terminate automatically or affect the definition of Journal of Governance Risk Management Compliance and Sustainability (JGRCS) or its sublicensee.
8. Miscellaneous
Journal of Governance Risk Management Compliance and Sustainability (JGRCS) will publish the article (or have it published) in the journal if the article’s editorial process is successfully completed and Journal of Governance Risk Management Compliance and Sustainability or its sublicensee has become obligated to have the article published. Journal of Governance Risk Management Compliance and Sustainability may conform the article to a style of punctuation, spelling, capitalization, referencing and usage that it deems appropriate. The author acknowledges that the article may be published so that it will be publicly accessible and such access will be free of charge for the readers
