Status Update

BSI’s Clear Criteria for Sovereignty

The BSI (Bundesamt für Sicherheit in der Informationstechnik | German Federal Office for Information Security) has shifted its focus beyond mere EU data center locations. True sovereignty now demands a robust mix of controls:

Technical control: Independent infrastructure with no external control plane.

Operational control: EU-based operations and fully isolated processes.

Legal independence: Legal independence (no exposure to third-country laws like the US CLOUD Act)

Data access control: Strict safeguards against unauthorized access, even by the provider itself.

These criteria ensure real autonomy, not just geographic checkboxes.

Why Hyperscalers Like AWS Are Adapting

AWS is reshaping its “European Sovereign Cloud” to match these standards:

• Dedicated infrastructure and governance structures.
• Operations staffed exclusively by EU personnel.
• Emphasis on data residency and process isolation.

This evolution reflects broader industry pressure to meet BSI expectations

The Persistent Legal Sovereignty Gap

Technical and operational tweaks fall short on the core challenge:

• AWS remains a U.S. company, vulnerable to laws like the CLOUD Act.

The BSI isn’t certifying AWS as sovereign—it’s partnering on standards development, not endorsing full compliance. This leaves a clear divide between “aligned” offerings and genuine sovereignty.

It’s a complex mix of political and legal issues that will take time to untangle, leaving a lasting sense of uncertainty.

What “True Sovereignty” Looks in Practice

The conversation has matured: Forget “Where’s the cloud?” - Ask “Who truly controls it?”

At iSystems, we deliver reliable IT hosting rooted in independence and robust architecture: fully controlled infrastructure, no reliance on external control planes and transparent access models. This positions us closer to authentic sovereignty than hyperscaler overlays.

Read how one of our partner companies, Krämer Anwendungssysteme GmbH & Co. KG, has chosen our cloud infrastructure to build a more sovereign and resilient future.

Sources:

_ https://www.heise.de/news/BSI-definiert-wann-eine-Cloud-wirklich-souveraen-ist-11272737.html

_ https://aws.amazon.com/blogs/security/introducing-the-overview-of-the-aws-european-sovereign-cloud-whitepaper/

_ https://www.aboutamazon.eu/news/aws/aws-and-bsi-sign-cooperation-agreement-to-advance-cybersecurity-and-digital-sovereignty-in-germany-and-the-eu