Status Update
BSI’s Clear Criteria for Sovereignty
The BSI (Bundesamt für Sicherheit in der Informationstechnik | German Federal Office for Information Security) has shifted its focus beyond mere EU data center locations. True sovereignty now demands a robust mix of controls:
Technical control: Independent infrastructure with no external control plane.
Operational control: EU-based operations and fully isolated processes.
Legal independence: Legal independence (no exposure to third-country laws like the US CLOUD Act)
Data access control: Strict safeguards against unauthorized access, even by the provider itself.
These criteria ensure real autonomy, not just geographic checkboxes.
Why Hyperscalers Like AWS Are Adapting
AWS is reshaping its “European Sovereign Cloud” to match these standards:
- Dedicated infrastructure and governance structures.
- Operations staffed exclusively by EU personnel.
- Emphasis on data residency and process isolation.
This evolution reflects broader industry pressure to meet BSI expectations
The Persistent Legal Sovereignty Gap
Technical and operational tweaks fall short on the core challenge:
The BSI isn’t certifying AWS as sovereign—it’s partnering on standards development, not endorsing full compliance. This leaves a clear divide between “aligned” offerings and genuine sovereignty.
It’s a complex mix of political and legal issues that will take time to untangle, leaving a lasting sense of uncertainty.
What “True Sovereignty” Looks in Practice
The conversation has matured: Forget “Where’s the cloud?” - Ask “Who truly controls it?”
At iSystems, we deliver reliable IT hosting rooted in independence and robust architecture: fully controlled infrastructure, no reliance on external control planes and transparent access models. This positions us closer to authentic sovereignty than hyperscaler overlays.
Read how one of our partner companies, Krämer Anwendungssysteme GmbH & Co. KG, has chosen our cloud infrastructure to build a more sovereign and resilient future.
Sources:
_ https://www.heise.de/news/BSI-definiert-wann-eine-Cloud-wirklich-souveraen-ist-11272737.html
