‘Digital sovereignty’ is not a black & white, yes/no promise. When it is used as a cloud service selling point, it functions as a broad label rather than a precise commitment. Furthermore, different services may have different elements or levels of ‘sovereignty’. This makes it difficult to understand what ‘sovereignty’ really means in practice and to compare cloud offerings — and their risks. Especially when each organisation has its own mix of risk profiles, regulatory obligations, business models and strategic objectives to consider. Decisions around digital sovereignty require careful assessment and clear discussions, both internally and with the cloud providers.
A practical checklist offering inspiration
To support our members, Beltug has created a practical checklist for these discussions. Developed with input from several Beltug members, it suggests some key questions you may choose to ask cloud providers, to help you assess sovereign cloud claims, identify relevant risks, and make well-informed decisions aligned with your strategic objectives.
This checklist is intended to provide inspiration; it is not a comprehensive list of questions to ask each provider or for each service. Its purpose is to help you focus your efforts after you have defined: what you need to protect, to what extent, and who should be involved. You can use it to better understand the sovereignty position of a current or potential cloud provider, to make an informed, risk-aware strategic decision.
Where do cloud providers stand?
To further support members in their decision-making, Beltug has invited cloud providers to answer the checklist and is publishing their responses. Their answers give our members a documented, comparable view of where each provider stands on sovereignty topics, offering exactly the kind of transparency the checklist was designed to encourage.
Orange and Combell are the first to respond; Beltug members can download their responses above.
What is included in the checklist?
The checklist covers several key sovereignty domains and topics:
Data sovereignty
- Data Location & Authority of the Customer
- Legal Jurisdiction
- Data Protection & Privacy
- Data Ownership & Control
- Exit Strategy & Portability
Operational sovereignty
- Support & Service Delivery
- Incident Management & Response
- Transparency & Reporting
- Compliance & Auditing
- Contractual Protection
Technical & infrastructure sovereignty
- Infrastructure Control & Ownership
- Data Centre & Physical Security
- Platform Independence & Technology Stack
- Access Control & Security
- Operational Autonomy
- Strategic Autonomy
Our warm thanks to all the members who contributed to the development of this checklist!