Research

Earlier this week, the white paper "Digital autonomy in practice: from dependence to control" was published by the Digital Autonomy project group, coordinated by Cyberveilig Nederland. DEFION contributed to this initiative as one of the participating organisations, alongside Atos, Cisco, DataExpert, Fox-IT, Northwave, Schubergphilis, Sentyron and Tesorion. The document deserves attention because it takes a topic that tends to stall in boardrooms and makes it concrete and actionable.

From sovereignty to demonstrable control

The greatest merit of the white paper is that it shifts the discussion. Where "sovereignty" is often seen as a political or legal end goal, in practice it comes down to demonstrable control. The relevant question is not whether your data resides within the EU, but who can access it, under what conditions, and how you verify that. Location can help, but in itself says little about access, key management, or the ability to switch providers.

International technology is not inherently the problem. In fact, an international provider with a well-designed setup can sometimes offer stronger security than a smaller European alternative. What matters are the controls around it, and the extent to which you can demonstrate they are in place.

Two threats, one discipline

For security professionals, the message will be familiar. The geopolitical threats around digital dependency do not represent a new category of risk, but a new manifestation of challenges the field has faced for decades. They can be mapped to two interconnected tracks.

Data sovereignty is essentially a confidentiality question. The most important measure is encrypting data and managing the encryption keys yourself, using a Dutch or European key management solution (BYOK or HYOK, for example). Whoever controls the key ultimately determines who can access the data, regardless of where the infrastructure physically resides.

Operational autonomy is about availability: how well do you continue to function when a provider, system, or environment fails? The measures organisations already take against ransomware and outages are directly applicable: an independent recovery environment, graceful degradation, and an adaptive architecture that switches over under disruption rather than coming to a halt.

Building blocks, not a final solution

The white paper also puts the "sovereign" cloud offerings of major providers in a measured perspective. They increase control and transparency, and frameworks such as SEAL help evaluate them, but they do not fully remove the underlying dependency. Digital autonomy only emerges when an organisation combines these building blocks with its own technical, organisational, and contractual measures. Responsibility for demonstrable control always remains with the organisation itself.

What this means for your organisation

What has changed in recent times is not the technology, but the urgency. The strategic agenda of the boardroom and the operational agenda of the security professional now point in the same direction. That alignment makes this the right moment to translate the sovereignty discussion into concrete decisions.

That is where we can help. DEFION supports organisations in mapping what is truly at stake: which data is unacceptably sensitive, which processes are critical, and which providers you depend on. From that analysis, we determine together which measures deserve priority, from independent key management and a tested exit strategy to a recovery environment and incident response readiness that holds up even when the primary environment fails.

Want to know what demonstrable control looks like for your organisation? Get in touch.

The white paper is available free of charge via Cyberveilig Nederland, in Dutch and English: Digital autonomy in practice: from dependence to control.

← Back to news