The European Commission is introducing a new system to express sovereignty in points. CISPE fears that this system will primarily favor the American cloud giants.
Digital sovereignty is one of the hottest IT issues in the European institutions. The European IT landscape is dominated by American tech giants, and policymakers are no longer happy with this. Various initiatives to change this are being announced, some more realistic than others.
read also
EU Sells Hot Air with Digital Sovereignty Strategy
The most recent initiative is the Cloud Sovereignty Framework, which can be seen as a ‘scorecard’ for cloud providers. Based on eight criteria, the framework assigns a score to both local and foreign operators. This should help determine which cloud providers can offer the most security in geopolitically uncertain times.
Sovereignty Score
In a publicly available document, the European Commission explains the framework. The score is a sum of eight sovereignty objectives determined by the Commission:
- Strategic sovereignty
- Legal sovereignty
- Data sovereignty
- Operational sovereignty
- Supply chain
- Security & compliance
- Enviromental sustainablity
One criterion carries a little more weight than the other for the final settlement. The supply chain determines a fifth of the total score, while sustainability accounts for 5 percent. Based on the score, the Commission then distinguishes five levels (Sovereignty Effectiveness Assurance Levels) of sovereignty:
- SEAL-0: no sovereignty
- SEAL-1: legal sovereignty
- SEAL-2: data sovereignty
- SEAL-3: digital resilience
- SEAL-4: ‘full’ digital sovereignty
Sovereign or Not
CISPE, the representative of European cloud providers, views the framework with a critical eye. According to the organization, it will be easier for the large American giants to get a good report than the local players. The opposite of what the Commission should be aiming for in CISPE’s view.
“The criteria are so broad that a provider can tick enough boxes to achieve a high score without really meeting the spirit of European sovereignty. Fundamentally, we believe that you are either sovereign or not.”, it says in a response to The Register.
read also
David versus Goliath: where is the European Microsoft?
The European Commission is convinced that it is putting clear and objective criteria first. “The framework provides clarity and transparency about what sovereignty entails and how this will be measured in government procurement. It creates a level playing field on which cloud providers on the EU market can demonstrate their strengths in the area of sovereignty,” a spokesperson clarified via The Register.