Storage
Mobility
Protection
Analysis and control
TOPICShare
Sovereign clouds are crucial for governments and highly secure organizations seeking to safeguard their data in accordance with local laws and regulations and out of concern to protect civilian and customer data. With sovereign cloud solutions, organizations can best protect sensitive information, align with compliance goals, and mitigate the risks of foreign access to their data.
In this article, we’ll take a more detailed look at sovereign clouds, including what it is, the challenges it faces, different approaches by major cloud service providers, and the capabilities of NetApp’s BlueXP, which offers deployment modes that support sovereign cloud needs.
Use these links to jump down to each section:
- What Is a Sovereign Cloud?
- The Challenges of Cloud Sovereignty
- Cloud Sovereignty by Cloud Service Provider
- How BlueXP Supports Cloud Sovereignty
- Sovereign Cloud: Ensuring Data Compliance and Control
- FAQs
What Is a Sovereign Cloud?
A sovereign cloud is a cloud computing infrastructure specially constructed to meet the laws and regulations of the country where it’s based. Data and metadata in these repositories are stored in a way that’s compliant with local regulations to protect against access from foreign countries or entities.
Sovereign cloud service providers need to monitor their clients’ storage to comply with local regulations. That being said, the requirements for a sovereign cloud usage vary depending on region and country, with some governments requiring stricter standards than others.
- Canada designates levels of security for clearance levels to sensitive government assets and information, ensuring that only those who need to access confidential data can see it.
- Australia’s Infosec Registered Assessors Program (IRAP) connects cyber security professionals with relevant services in order to secure Australian industry and government data.
- The United States’ Cloud Smart Policy and Canada’s Cloud-First Policy were introduced to assist federal agencies in transitioning to secure cloud infrastructures.
- Germany’s Bundescloud is part of its IT service consolidation, deploying a dedicated cloud platform where federal government data is required to be stored.
- The UK government has mandated its central departments to adopt the Cloud First policy, with Crown Hosting recommended for sovereign on-prem requirements.
- India’s MeghRaj is a cloud initiative with guidelines for expediting the delivery of e-services, accelerating application development and deployment, and optimizing infrastructure costs.
- Israel’s Project Nimbus to establish a cloud services supply channel, shape government policies regarding cloud migration and service modernization, and enhance control and optimization of cloud-based activities.
The Rise of the Public Cloud Created the Need for Cloud Sovereignty
The growing reliance on the public cloud has led governments to enact guidelines and restrictions for sovereign cloud requirements. As more agencies and government organizations adopt cloud services for data storage, concerns surrounding security, privacy, and jurisdiction come up.
Here’s how the need for cloud sovereignty can be attributed to the rise in demand of the public cloud:
- Third-party storage concerns
Using the public cloud, an organization’s data is stored by another party, meaning the organization doesn’t always have direct control over storage practices. This can be an issue for government agencies or organizations that handle secure data as it makes compliance more challenging.
- Designating legal jurisdiction
With data stored and processed in data centers spread around the world, using the public cloud for sensitive information can lead to issues of legal jurisdiction. Cloud sovereignty regulations seek to address this challenge by ensuring data is protected under the laws of a specific country.
- Local data compliance
While organizations are increasingly drawn to the benefits of the public cloud—such as its cost efficiency, scalability, flexibility, and overall accessibility—governments often demand that use of the public cloud by their agencies meets compliance standards out of the box. Cloud sovereignty regulations aim to balance public cloud use and its benefits with local laws.
- Data processing location
When data is processed in multiple geographic locations this can have an impact on performance as well as legal implications. Cloud sovereignty regulations work to address these concerns and align with local regulations.
- Encryption key management
Cloud sovereignty regulations should include encryption key management processes in order to protect sensitive information from unauthorized access or use.
- Rogue administrator safeguards
The considerations of cloud sovereignty regulations should also extend to preventing intervention from a cloud provider’s rogue administrator who can access sensitive data. Regulations need to be put in place to mitigate this potential risk.
Challenges that Come With Cloud Sovereignty
Cloud sovereignty has many benefits, from ensuring sensitive information remains secure to reducing the chance for unauthorized access and data breaches. But cloud sovereignty also presents several obstacles that need to be addressed.
Here are a few common challenges facing organizations looking to enact a sovereign cloud:
- Compatibility issues with existing infrastructure
Compatibility issues can arise when trying to connect and migrate data and applications from on-premises environments or different cloud providers to a sovereign cloud. This can require additional efforts and resources for integration, testing, and ensuring smooth interoperability.
- Potential for government overreach
While the purpose of a sovereign cloud is to provide control and security over data, there’s a potential risk of government overreach and excessive surveillance. Misuse of data can arise if governments or individual government officials act unlawfully. Striking a balance between data protection and government access is crucial to maintain trust and transparency.
- Interrupts pace of technology adoption
With a focus on strict regulations and compliance, sovereign clouds can slow down the adoption of new technologies and services. This can limit the ability to quickly develop and implement new technologies, innovations, and advancements, and can be discouraging for organizations.
- Data sovereignty considerations
Data sovereignty in a sovereign cloud often emphasizes the location and control of data at rest, such as the storage and processing of data within a country's borders. However, ensuring sovereignty during transit can be complex. It can be challenging to establish secure data transfer mechanisms while complying with data protection regulations.
Cloud Sovereignty by Cloud Service Provider
Each service provider has taken its own approach to addressing cloud sovereignty. Here’s how the three major providers—Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP)—have approached the problem of cloud sovereignty.
AWS Cloud Sovereignty
AWS has boasted sovereignty in its cloud services since its inception, stating that control over the location and movement of customer data is essential. AWS aims to make its cloud sovereign-by-design, offering users a number of features to safeguard data. With AWS, you can:
- Set the location of your workloads on AWS by choosing to deploy data in any of the 31 available global regions with several tools that allow you to control how data is stored, secured, and accessed
- Restrict access to data using specialized software and hardware to prevent unauthorized outside access with the AWS Nitro System
- Encrypt data at rest or in transit with encryption keys that are managed either inside or out of the AWS cloud
- Strengthen cloud resilience as each AWS region has multiple AZs to provide continuous availability, in addition to several data resilience capabilities in the event of a disaster
To learn more, visit the AWS cloud sovereignty page.
Azure Cloud Sovereignty
Azure emphasizes the concept of "Cloud for Sovereignty" and provides a range of solutions tailored to address sovereignty concerns, such as:
- Data residency options enable customers to choose the specific region where their data is stored and processed
- Azure is designed to meet government needs, ensuring that its services comply with local policies and regulations
- Advanced sovereign controls allow you to set security and privacy levels, customize policy controls, and automate enforcement
- With over 60 Azure regions, there are many options to meet local sovereignty requirements
To learn more, visit the Azure cloud sovereignty page.
GCP Cloud Sovereignty
GCP collaborates with external partners to optimize sovereign controls and provide additional assurance and capabilities for its cloud. Here’s what you can expect with GCP:
- Control your data residency by storing customer data at rest in certain GCP regions and restricting that data from moving externally
- GCP’s partners manage encryption keys, so users need to call outside of Google to access externally managed keys
- Google logs and audits all access to customer data, which is only allowed under specific predetermined conditions
- Google’s Digital Sovereignty Explorer offers personalized reports that point out areas that need attention and tailored sovereignty solutions
To learn more, visit the Google Cloud approach to cloud sovereignty page.
How BlueXP Supports Cloud Sovereignty
NetApp BlueXP is a consolidated control panel that offers organizations a hybrid multicloud experience to help them store and manage data across on-premises and cloud environments. It’s a single portal for NetApp’s data services, and crucial to many enterprise and governmental cloud deployments around the world.
Normally, BlueXP is deployed in Standard mode, which is SaaS based, with automated deployment and updates. But to support sovereign cloud requirements, BlueXP has two other deployment options that restrict internet access: the Restricted and Private modes.
- Restricted Mode
In Restricted mode, access to the BlueXP SaaS layer is extremely limited. The BlueXP Connector is installed in a government, sovereign, or commercial cloud keeping data within a specific geographical region, excluding some metadata which is sent back to the BlueXP backend. There’s limited outbound connectivity to the SaaS backend, and BlueXP is accessed locally from a web-based console.
This mode can help organizations such as governments and regulated companies comply with data sovereignty laws and regulations, as data remains in a designated region. It provides a higher level of control and security, reducing the risk of data exposure to external entities.
- Private Mode
Unlike Restricted mode, in Private mode, a BlueXP connector is not connected to the BlueXP SaaS layer, allowing you to operate the system in a completely isolated environment. To make this happen, the BlueXP Connector is installed in the customer’s environment or in a secure government or sovereign cloud region.
Private mode is ideal for highly secure organizations that need their deployments to be completely inaccessible from the BlueXP SaaS.
All the cloud sovereignty benefits of Restricted mode apply to Private mode with one major addition: Without access to the SaaS layer, all installation and updates are done manually. That gives organizations full control over changes made to the software so customers can better align with cloud sovereignty requirements.
If you’re looking for enhanced control over your cloud infrastructure and data storage, read more about BlueXP's Restricted and Private deployment modes. You can also see how it works in the BlueXP deployment mode documentation.
Sovereign Cloud: Ensuring Data Compliance and Control
The sovereign cloud has become vital for organizations that need to protect their data in compliance with local regulations. The increased reliance on the public cloud, coupled with the need for data compliance and security, has led to the demand for sovereign cloud infrastructure. While not without its challenges, the benefits of a sovereign cloud can’t be ignored, and it will continue to play an important role in data security for highly secure organizations.
BlueXP stands out by providing dedicated deployment modes to support sovereign cloud requirements. Offering enhanced control, data security, and compliance capabilities, BlueXP helps organizations protect sensitive information and meet strict sovereign cloud regulations.
FAQs
● What is an example of a sovereign cloud?
An example of a sovereign cloud is the Open Telekom Cloud founded by GAIA-X in Europe. This cloud is a completely European platform that offers full data sovereignty that meets local standards and regulations.
● What is the sovereign cloud strategy?
A sovereign cloud strategy is a government’s plan to establish data security and privacy regulations in cloud computing services. This facilitates adopting and deploying cloud infrastructures and services that are compliant with local laws.
● What is the Azure sovereign cloud?
Azure has detailed a range of services and benefits that it has implemented to support cloud sovereignty on its platform. From data centers located in more than 60 cloud regions and controls to help secure data, you can read about Azure’s sovereign cloud options on this page.
