Digital sovereignty

Digital sovereignty refers to the ability of a state, organization, or company to control its digital destiny by controlling its data, technological infrastructure, and strategic choices in information technology. It is crucial because it enables: 

• Ensuring technological independence from foreign players 

• Protecting sensitive data from the extraterritoriality of foreign laws 

• Ensuring business continuity even in times of geopolitical tension 

• Strengthening resilience in the face of supply disruptions or international sanctions 

• Protecting national or European economic and strategic interests 

Several regulatory frameworks govern digital sovereignty in France and Europe: 

SecNumCloud - ANSSI repository defining security requirements for cloud service providers wishing to host sensitive data. 

Cybersecurity Act - European regulation that strengthens the role of ENISA and establishes a European certification framework for digital products and services. 

PSEE (Prestataires de Service Essentiels à l'État) - French framework governing providers of critical services to government agencies. 

Cloud de Confiance - French initiative aimed at certifying cloud offerings that meet strict sovereignty and security criteria. 

Digital sovereignty and cybersecurity are complementary but distinct: 

• Cybersecurity focuses primarily on the technical protection of systems against threats (malicious acts, errors, accidents). 

• Digital sovereignty addresses broader issues such as:  

• Independence from foreign suppliers 

• Protection against the extraterritoriality of laws 

• Complete mastery of the technological chain 

• The ability to operate independently in the event of a geopolitical crisis 

• Preserving national economic and strategic interests 

A comprehensive sovereignty approach necessarily incorporates robust cybersecurity measures, but goes beyond that by also addressing legal, economic, and geopolitical dimensions. 

Your digital sovereignty can be assessed in several ways: 

Technical dimension: 

• Dependence on foreign technologies that cannot be replaced 

• Ability to maintain and upgrade your systems without external intervention 

• Mastery of source codes and critical data 

Legal dimension: 

• Exposure to extraterritorial legislation (Cloud Act, FISA, etc.) 

• Location of data and processing 

• Nationality of service providers and subcontractors 

Organizational dimension: 

• Internal expertise in sovereign technologies 

• Digital sovereignty governance 

• Supplier qualification process 

Strategic dimension: 

• Visibility into your technology supply chain 

• Continuity plans in the event of disruption to access to foreign technologies 

• Supplier diversification and reduction of critical dependencies 

Our assessment methodology systematically examines these dimensions to establish an accurate map of your level of sovereignty and identify priority actions to be taken.

A digital sovereignty approach brings many tangible benefits: 

Strategic advantages: 

• Greater decision-making independence 

• Reduction of geopolitical risks 

• Preserving competitive advantages 

• Complete control over your intangible assets 

Operational benefits: 

• Better business continuity 

• Enhanced resilience in the face of crises 

• Ability to operate even in the event of sanctions or restrictions 

• Improved traceability and infrastructure control 

Regulatory advantages: 

• Compliance with sector-specific requirements (defense, healthcare, OIV/OSE) 

• Protection against extraterritorial access requests 

• Alignment with national and European public policies 

• Favorable positioning for public procurement requiring sovereignty guarantees 

Image benefits: 

• Competitive differentiation 

• Strengthened trust among sensitive customers and partners 

• Recognizing commitment to the protection of national data 

• Attractiveness to talent sensitive to sovereignty issues 

There is a common misconception that sovereignty necessarily means higher costs and lower performance. Here's how to reconcile these two aspects: 

Progressive and targeted approach: 

• Prioritize the systems and data that are truly critical to your business 

• Adopt a differentiated approach depending on the level of sensitivity 

• Plan a phased transition to spread out investments 

Pooling and ecosystems: 

• Relying on shared sovereign clouds to reduce costs 

• Participate in sectoral or national initiatives 

• Collaborating with the ecosystem of sovereign actors 

Hybrid models: 

• Design hybrid architectures combining sovereign solutions for critical functions and global solutions for less sensitive functions. 

• Establish secure gateways between environments 

• Organize data governance according to their level of sensitivity 

Valorization of indirect benefits: 

• Reduction in potential costs associated with security incidents 

• Reduction of legal and regulatory risks 

• Privileged access to certain markets requiring sovereignty guarantees 

• Development of valuable internal skills 

Our approach aims to identify the right balance between sovereignty, performance, and costs, tailored to your specific context. 

The transition to greater digital sovereignty must be methodical: 

Assessment and strategy phase: 

• Map your current technology dependencies 

• Identify critical systems and data requiring sovereign protection 

• Define a target vision and a roadmap tailored to your challenges 

Design phase: 

• Select the sovereign solutions tailored to your needs 

• Designing target architectures 

• Plan migrations in successive waves 

• Prepare teams for change 

Implementation phase: 

• Deploy sovereign infrastructure 

• Gradually migrate workloads and data 

• Implement governance processes 

• Train teams in new technologies 

Continuous improvement phase: 

• Regularly measure your level of digital sovereignty 

• Adapting to regulatory and technological changes 

• Continuously optimize your device 

• Develop your long-term independence 

Our support covers all of these phases, with particular attention paid to ensuring the continuity of your activities during the transition. 

Several challenges are commonly identified when implementing a digital sovereignty strategy: 

Technological challenges: 

• Finding sovereign alternatives that are as effective as established solutions 

• Ensure interoperability with the existing ecosystem 

• Maintain a comparable level of innovation 

Organizational challenges: 

• Develop internal expertise in sovereign technologies 

• Managing resistance to change 

• Integrating sovereignty into decision-making processes 

Economic challenges: 

• Justify investments to decision-makers 

• Maintaining competitiveness in the face of less constrained players 

• Balancing short-term costs and long-term benefits 

Strategic challenges: 

• Anticipating geopolitical and regulatory developments 

• Maintain effective monitoring of emerging threats 

• Continuously adapt the level of sovereignty to the context 

Our support approach incorporates proven methodologies to overcome these challenges, taking into account your specific context and constraints. 

New European regulations indirectly reinforce digital sovereignty requirements: 

NIS2 : 

• Significantly expands the scope of entities concerned 

• Imposes supply chain risk management measures 

• Strengthens supplier control obligations 

• Requires robust IT governance that promotes control over systems 

DORA (for the financial sector): 

• Requires strict management of third-party risks 

• Strengthens operational resilience requirements 

• Requires advanced penetration testing that requires a good knowledge of systems 

• Requires incident response capabilities that promote autonomy 

Cybersecurity Act: 

• Establishes European certification schemes 

• Promotes the emergence of certified European solutions 

• Strengthens confidence in European products and services 

These regulations create a favorable environment for digital sovereignty by promoting risk management, transparency, and resilience, which are key aspects of a sovereign approach. 

Selecting suppliers that meet your sovereignty requirements requires a rigorous methodology: 

Legal criteria: 

• Location of headquarters and subsidiaries 

• Legislation applicable to the supplier 

• Capital structure and shareholding 

• Contractual clauses protecting against extraterritorial access to data 

Technical criteria: 

• Location of technical infrastructure 

• Control of update and support channels 

• Transparency regarding subcontractors and their location 

• Encryption and key management capabilities 

Organizational criteria: 

• Nationality of teams with access to your data 

• Procedures for managing government access requests 

• Certification and qualification (SecNumCloud, ANSSI, etc.) 

• Data transfer policies 

Strategic criteria: 

• Sustainability and supplier independence 

• Alignment with regulatory requirements in your industry 

• Ability to evolve with your sovereignty needs 

• Supplier partner ecosystem 

Our supplier evaluation methodology incorporates these criteria into an analysis grid weighted according to your specific priorities. 

Security certification is a formalized process whereby an organization certifies that its information system is protected in a manner appropriate to the identified risks. This certification, issued by an internal authority (usually a senior manager), is an essential pillar of digital sovereignty for several reasons: 

Managing sovereign risks: Certification requires an in-depth analysis of threats, particularly those related to foreign actors or the extraterritoriality of certain laws. 

National regulatory framework: Mandatory for government information systems, OIVs/OSEs, and certain regulated sectors, it ensures compliance with French requirements defined by ANSSI. 

A structured 9-step process ensuring a methodical approach to protecting strategic digital assets. 

Independent control of supply chains: Certification involves identifying and controlling technological dependencies, thereby strengthening the autonomy of critical systems. 

Limited duration (generally 3 years) requiring periodic reassessment to maintain an appropriate level of protection in light of evolving international threats. 

Difference from certification: Unlike standardized international certifications, accreditation is contextualized and tailored to the specific characteristics of each organization, with a strong focus on geopolitical risk analysis. 

Certification is therefore an essential lever for establishing and maintaining true digital sovereignty, ensuring that critical information systems are under control and that risks associated with external dependencies are identified and managed.