Sovereign cloud selection: the criteria that matter under NIS2, DORA and GDPR

Why it matters

Sovereign or regional variants of a global platform often lag behind the main catalog by months or years: fewer managed services, later feature releases, smaller instance types, missing regions for failover. Architectures designed against the global documentation then fail in the sovereign environment, or drift back toward the global one, which quietly undoes the sovereignty you paid for.

Why it matters

A sovereign platform still has to fit into the controls you already run. If it cannot federate with your identity provider, your administrators get a second set of accounts outside your MFA policy; if its audit and platform logs cannot be exported to your SIEM in a usable schema, incidents on that platform are invisible to the team that has to report them within 24 hours; and if its APIs and infrastructure-as-code support lag the global platform, every automation you own has to be rebuilt.

Why it matters

A sovereign region is usually smaller than a global one: fewer availability zones, less spare capacity, smaller instance families. Capacity that is abundant in the global platform can be scarce here, and the burst you plan for month-end or a marketing campaign may not be there when you ask for it. Performance measured in the global region says nothing about the sovereign one.

Why it matters

Moving to a sovereign platform is a migration project, and running on it is a daily job. How workloads are onboarded, how the platform is patched and upgraded, what the provider does versus what your team does, and how a rollout across hundreds of virtual machines is staged decide whether the platform is operable with the team you have. A sovereign platform with weaker tooling can cost more in people than it saves in risk.

Why it matters

You cannot report an incident you cannot see. Under NIS2 you have 24 hours for the early warning, and that clock starts when you become aware, which depends on the platform telling you. Observability means the platform's own audit logs, access logs, control-plane events and metrics are available to you completely, quickly and in a form your monitoring can consume, including who from the provider's side touched your tenant.

Why it matters

Sovereignty has at least three layers: legal (which jurisdiction can compel access), operational (who runs and supports the platform, from where) and technical (who holds the keys and can read the data). An EU-registered entity that is a subsidiary of a non-EU parent can be within reach of that parent's laws, including the US CLOUD Act, which addresses data in the provider's possession, custody or control regardless of location. A provider can deliver one layer and market all three.

Why it matters

Data stored in an EU region can still be operated, monitored and debugged by engineers sitting elsewhere. Remote support access is a data transfer under the GDPR, and after Schrems II you need a legal basis and safeguards for it. The processor contract under Art. 28 and the technical and organisational measures under Art. 32 have to describe what the provider actually does, and the sub-processor list has to be complete.

Why it matters

C5, ISO 27001 and SOC 2 reports cover a defined set of services, regions and time periods. The provider is not certified, specific services in specific locations are. If the service you plan to run, in the region you plan to use, is outside the scope, the certificate on the website does nothing for your audit file.

Why it matters

If you are a financial entity under DORA, a cloud platform supporting critical or important functions falls under the strictest contract rules, and Article 30 sets the contractual minimums: service descriptions and locations, data protection provisions, access, audit and inspection rights, termination rights, exit assistance and incident cooperation. Under NIS2 the provider is part of your supply chain and must notify you fast enough for your 24-hour early warning. A contract that lacks these cannot be fixed with an internal policy.

Why it matters

DORA requires financial entities to maintain a register of information on all ICT third-party arrangements, including subcontractors that support critical functions, and gives them audit and inspection rights. NIS2 Art. 21 requires supply-chain security measures for every essential and important entity. Both depend on the provider telling you which subcontractors are actually behind the service, letting you or your auditor verify it, and telling you again when the chain changes.

Why it matters

Cloud pricing is a system of hundreds of meters: compute, storage tiers, requests, egress, support plans, reserved versus on-demand. The list price of a virtual machine is the smallest part of what an estate of several hundred machines plus storage costs over three years, and sovereign offerings often carry a premium on every meter. A comparison on list prices picks the wrong platform.

Why it matters

A sovereign platform is usually more expensive than the global one, and the premium buys something: reduced legal exposure, a defensible audit file, workloads you could not otherwise move to the cloud at all. The decision is whether that value is worth the premium for the workloads in question, and that is only answerable if the value is named: which risk is removed, which regulated workload becomes possible, which audit finding disappears.

Why it matters

A three-year commitment on a platform that is still catching up to the global catalog is a bet. Contract flexibility is what limits the downside: the right to scale down, to leave early with a defined penalty, to move committed spend between services, to renegotiate when a service you depend on is discontinued, and to terminate when the provider changes ownership or sub-processors. DORA Art. 28 and 30 require termination rights for critical functions in any case.

Why it matters

Every regulator asks for an exit strategy, and DORA makes exit plans for critical services an explicit requirement. An exit that is technically possible but costs a year of engineering and a seven-figure egress bill is not an exit, it is a hostage situation. Lock-in has three dimensions: cost, format and time, and proprietary managed services add a fourth, the code you wrote against them.

Why it matters

A platform change costs your own people before it saves anything: engineers who learn a new console and API, operations staff who rebuild runbooks, security staff who re-validate controls, and a migration team for the duration. A sovereign platform with a different tool chain than the global one you know multiplies that. The internal effort is part of the cost and the timeline, and it is the part vendors never quote.

Why it matters

Your own plans for the next one to two years (a new ERP, a data platform, a Kubernetes standard, a security tooling consolidation) need services the platform must have by then. Sovereign platforms publish roadmaps for catching up with the global catalog; if the service your project depends on is on that roadmap rather than in the catalog, your project timeline now depends on the provider's.

Why it matters

A platform decision either supports the IT and security strategy you have written down or quietly replaces it. If your strategy says zero trust, identity-centric access and a single SIEM, a platform that cannot federate identities or export logs pulls the strategy apart. If it says multi-cloud with portable workloads, a platform full of proprietary managed services pulls it apart from the other side.

Why it matters

EU regulation on cloud is still moving: the Data Act's switching and interoperability rules, the EU cloud certification scheme, the AI Act's requirements for AI systems, the Cyber Resilience Act for products with digital elements. A platform whose provider is structurally unable to meet the next requirement, or whose ownership makes it a target of the next transfer ruling, costs a second migration. Future-proofing is asking which of those the provider is preparing for.

Why it matters

Putting every critical function on one provider is a concentration risk that DORA and NIS2 both expect you to assess, and your supervisor will ask what happens if that provider fails, is sanctioned or is acquired. A sovereign provider is often smaller than a hyperscaler, which makes its own financial stability and ownership part of the risk. A second provider only reduces the risk if a workload can actually run there, which most multi-cloud architectures never test.

Why it matters

A sovereign platform can be run as a standard offering, with the provider's reference architectures, managed services and defaults, or as a custom build tailored to your estate. Standard is cheaper, better supported and easier to audit; custom fits better today and ages worse, because every deviation is yours to maintain through every platform upgrade. The decision is how far off the standard path your requirements actually force you.

Why it matters

Cloud platforms price by consumption, by reserved capacity, by committed spend or as a flat private-cloud fee, and each model suits a different estate. Consumption pricing rewards elastic workloads and punishes steady ones; reservations and commits reward predictability and punish change; a flat fee is only cheap if you fill it. The model has to fit how your workloads actually behave, not how the provider's example does.

Why it matters

Cloud pricing is a system of hundreds of meters, and the ones that surprise are never on the quote: egress, cross-zone traffic, API requests, snapshot storage, log retention, premium support, and price changes the provider can make during the term. The published SLA with service credits is a refund policy, not a resilience guarantee, and credits rarely cover the business loss of an outage.

Why it matters

The quoted price for your target architecture is the number the board compares. It is only comparable between providers if each quote covers the same scope: the same instance sizes, storage classes, egress volume, backup, support tier, sovereignty guarantees and contract term. A sovereign quote that is 30 percent higher than a global one may be buying three layers of sovereignty, or one; a quote 30 percent lower than another sovereign one may be leaving out the support you need.