Cloud-Strategy

Sovereignty is no longer just a privacy or data-residency question. It has become a question of strategic control, resilience, and competitiveness across the entire digital stack. The debate is not about decoupling. It is about understanding the levers that others hold over critical operations, and deciding deliberately which ones to accept, mitigate, or neutralize. For CIOs and risk leaders, sovereignty decisions now shape uptime, legal exposure, cost trajectories, and time‑to‑market – not just compliance. ...

— or rather, why more control can still leave you less sovereign April 2025. The Iberian peninsula loses power. Continental Spain and Portugal go dark, the most severe power-system failure in Europe in more than twenty years. Power is largely restored within about a day. When the grid fails, data centers fall back on diesel generators. When power goes out for long enough, diesel reserves run down. Standard reserves last 24 to 72 hours. Beyond that, every operator depends on resupply. And resupply, during a regional crisis, doesn’t happen on first-come-first-served terms. ...

This is the second of two articles on a sovereignty paradox. The first, Control Isn’t Sovereignty?, argued that delegating to systems with broader resilience can produce more outcome sovereignty than direct ownership. This one is about the harder question underneath. Most sovereignty design follows the same logic. To protect operations against grid failures: Install generators on site. Stock diesel reserves to keep them running through an extended outage. Arrange supply contracts with fuel suppliers for resupply during a crisis. ...

If the series has a point – that sovereignty measures can silently shift under you – this article is where it caught up with me. One of those measures shifted under it, after I hit publish, and I spotted it months after. Written against CSF v1.2.1; the June 2026 guidance changed how the overall SEAL level reads – update at the end. Still worth your time – most of it stands. One part has dated: the article flags that an overall SEAL could hide an extreme low; the new EU guidance has since fixed that. ...

Sovereignty done right makes you resilient. But sovereignty you don’t operate is the opposite: a risk. You move a workload in-house to be more sovereign. Your jurisdiction, your rules, no outside provider in the loop. More control – which was the point of the move. But the provider you left wasn’t only running the service. They were also keeping it up, patching it, and making sure you could still reach it when something broke. You didn’t see that part, because you never had to. ...

A global company decides to become fully sovereign. Every system in its own data centers, in its own jurisdiction. Foreign providers out, cross-border transfers stopped, the estate air-gapped. Customer data untouchable, IP locked down. Then it goes bankrupt. It was in the pizza delivery business, and the ordering platform was inside the air gap with everything else. Of course nobody would do this. But notice what went wrong: not the ambition, not the execution. They applied it uniformly. The recipe and the order line got the same treatment, and only one of them needed it. ...

Your postman can’t read your letters. He knows a great deal about you anyway – who writes to you and how often, the envelope from the bank, the law firm, the hospital, the official-looking window envelope. He never opens a thing and could still sketch your month from the outside of your mail. And he’s only the part you can see. Behind him a sorting system logs every item, and an operator could be asked by a court who sent you what. None of them read the contents. They don’t need to. This is metadata, and the first thing to notice is that it’s old – recording the outside of the envelope is centuries of postal practice, not a new failure of the cloud. Which is the clue that you can’t make it go away. It isn’t a leak someone introduced. It’s how any delivery system works. ...

Do you need to be sovereign? And if yes, for what? This is the last article in the series, so let me start with answering this question. Sovereignty is contextual; not everything needs to be sovereign. And just because someone else treats a workload as sovereign doesn’t mean it has to be for you. The first move is always deciding whether the yes is even yours. Deciding in whose interest, and whether the pursuit is worth it at all, is a piece in its own right – one the loop doesn’t answer. But assume you’ve asked it honestly, and for some part of your estate the answer is yes. ...