EU-based operations & support

Why important?

Sovereignty requires operational control (admin/support).

How measured?

• 0 = Operations/support mainly outside the EU
• 1 = EU support only for 1st/2nd level; break-glass/3rd level outside the EU or unclear
• 2 = EU support during core hours, but remote/offshore access possible (processes unclear)
• 3 = EU-based operations & support with a defined access concept, residual uncertainties
• 4 = EU-only operations & support largely documented, break-glass strictly regulated
• 5 = EU-only operations & support + strong access model (audit, possibly zero operator access) evidenced
• N/A = no reliable evidence

Sources / Evidence

• https://aws.eu/de/
• https://www.aboutamazon.eu/news/aws/built-operated-controlled-and-secured-in-europe-aws-unveils-new-sovereign-controls-and-governance-structure-for-the-aws-european-sovereign-cloud
• https://stackit.com/en/why-stackit/benefits/data-sovereignty
• https://www.ovhcloud.com/pl/bare-metal/secnumcloud/
• https://www.t-cloud-public.com/en/benefits/sovereignty
• https://www.oracle.eu/faq/
• https://news.microsoft.com/de-de/erste-souveraene-cloud-plattform-fuer-die-deutsche-verwaltung-auf-der-zielgeraden/
• https://www.plusserver.com/wp-content/uploads/2023/09/20251014_plusserver-ISO-27001-2022-Zertifikat-und-Statement-of-Applicability-SoA-DE.pdf
• https://learn.microsoft.com/en-us/industry/sovereign-cloud/concepts/operational-controls
• https://learn.microsoft.com/en-us/compliance/assurance/assurance-sovereignty-cloud-operator-access
• https://www.noris.de/wp-content/uploads/noris-Sovereign-Cloud-Product-Sheet.pdf
• https://www.syseleven.de/en/press-releases/syseleven-and-secunet-now-with-it-grundschutz-iso-27001-and-c5/

Validation questions (RFP)

• Who has root/break-glass access? Where are 1st/2nd/3rd level support located? How are support accesses logged?

Scores comparison