Criteria Enabling Cloud Computing Autonomy
Article URL: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/C3A/C3A_node.html Comments URL: https://news.ycombinator.com/item?id=47926579 Points: 1 # Comments: 0
Article URL: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/C3A/C3A_node.html
Comments URL: https://news.ycombinator.com/item?id=47926579
Achieving digital sovereignty requires strengthening the European market and its domestic digital industry in key technology sectors. The BSI actively supports this goal in the area of cybersecurity. At the same time, the BSI takes the position that non-European products — wherever their continued use is intended — must be secured in a way that enables self-determined usage. The criteria catalogue C3A provides transparency and guidance, and enables organizations to select cloud services based on the criteria most relevant to their specific use case.
Digital sovereignty describes the abilities and opportunities of individuals and institutions to be able to perform their role(s) in the digital world independently, self-determinedly (autonomous) and securely.
The decision to use cloud services is based on the shared responsibility model, which means that responsibility is shared between the cloud service provider and the cloud service customer. This model inherently limits the scope of decisions that the cloud service customer is able to take, including those that impact the customer's digital sovereignty. Cloud service providers can enable their cloud service customers to maintain the desired degree of self-determination in various ways — or not. To ensure transparency and enable cloud service customers to make risk-based decisions in this context, there is a need for generally recognized, objective, and verifiable criteria for self-determination i.e. autonomy.
C3A - Criteria enabling Cloud Computing Autonomy provide a set of criteria for assessing whether a given set of cloud services allows for self-determined use within its respective risk context. C3A are a guiding framework and are intended to increase transparency. The C3A Framework is not binding in itself.
EU Cloud Sovereignty Framework and BSI C5 :2026 as the C3A foundation
C3A adopt the structure (categorization) and objectives of the EU Cloud Sovereignty Framework ( EU CSF). In addition, the contributing factors of the EU CSF are reflected in the verifiable criteria of the C3A , but are expanded to include further aspects.