Step 1: Understand Your Data and Dependencies

Before you can really take action, you should know where to start, especially in complicated IT landscapes. Start with your core business processes and do the following:

• Identify your data: Identify all data you store and process, its level of sensitivity, and where it is currently located.
• Map your technology stack: Create a diagram of the IT infrastructure supporting your business processes, including SaaS (Software as a Service) providers, cloud platforms (PaaS & IaaS), and internal systems. You might need to start at business processes to get an accurate map.
• Identify critical data flows: Determine how the data moves through your systems. This helps prioritise what needs to be protected first.

Possible Challenges

This first step is a foundational one  you should take regardless of specific risks, because it helps you mitigate many other risks as well. And, while it sounds simple, it's often the hardest. It requires a thorough process to identify every piece of data, from customer records to internal emails and everything in between. This process is time-consuming and can be a significant logistical challenge, especially for large companies with complex IT ecosystems. Therefore, it is important to start with the core business processes, which will likely introduce the biggest business risk if the data becomes unavailable.

Step 2: Assess your risk

For each of the threats we described in the previous blog, and any other digital autonomy related threats you find relevant, assess the risk it poses to you. How can this threat materialise against your organisation, what would happen if it materialises, and how bad is that? This risk assessment will help you decide where you need to make changes and against which costs.

This risk assessment should follow the format you use for your broader security management. And if you haven’t adopted such an approach yet, various frameworks (e.g. ISO27005, the NIST RMF or FAIR) are great resources. But even less extensive, just asking the question, “What would happen to my business process if this application, data or service is not available anymore?” can already give a very clear idea on how to prioritise processes, suppliers and assets.

Step 3: Set your ambition

With the risks in mind, think about what you want your digital autonomy to look like ideally. If the products and supplier existed, where would you like your data and services to be hosted? What level of control would you have?

Use the map from step one and mark which solutions you would want to be hosted by European legal entities and/or in European countries, or what other digital autonomy properties you want them to have (see our previous blog for those). For components in your architecture that you mark in this way, describe the functional and non-functional requirements the component needs to comply with.

Step 4: Explore available options

Based on the desired state from step two, search for solutions that fulfil the functional and non-functional requirements that you formulated in the previous step. It’s most likely that you will find solutions for only a few of those components, and not for the most complex ones (like Microsoft 365).

However, for some classes of components it will be easier to find replacement than for others. Finding a European (entity, hosted) IaaS platform for instance is doable, and the features they offer approach those of the US hyperscalers in the ways that are relevant for most companies. There are some candidates for PaaS but it’s a bit more difficult, and for SaaS it’s most difficult.

Step 5: Implement the options you can

Now that you have some options to replace current solutions or vendors with ones that increase your digital autonomy, it’s time to start moving. In this step you start or plan projects to explore migration to those selected components. For some solutions this might be fairly simple, but the higher up in the cloud stack a solution is and the more connected it becomes to other IT components, the more difficult migration.

Step 6: Find stop-gap measures

After taking the steps that are feasible with the solutions and services available, you’ve moved a bit closer towards your goal in digital autonomy. Chances are, however, that you haven’t reached that goal. Now, it’s time to look at the gap between where you are and where you want to be, what level of risk that brings, and whether you can implement temporary workarounds or partial solutions, or whether you accept the risk.

For the solutions that are not at the desired end-state, what risks does this leave you with? For example, if you haven’t been able to find a replacement for Microsoft 365 for online collaboration in documents, spreadsheets, and presentations. The next-best candidate, Google, doesn’t improve your digital autonomy, and European solutions fall behind in functionality. So, what now?

In this step, look at measures you can take to reduce your risk that aren’t necessarily the things you had in mind when you set your ambition. These can be temporary solutions, alternatives for only a subset of your data or services, and so on. It could also be that you protect against certain risks by having backups of all your data that reside outside of the vendor you are backing up from, so you’ll retain access to those if you get locked out.

Example Case

Consider other possibilities than completely replacing cloud services. One company we assisted in this process decided to keep their on-premises infrastructure alive and even invest in making it more future-proof so that it will last them another three years. During that time they’ll keep their most sensitive data on servers on-premises. After three years, they hope there are more European SaaS options available and they’ll revisit the decision. Another company chose a Europe-based secure cloud storage solution that they use for sensitive documents, instead of Microsoft SharePoint.

Step 7: Rinse and repeat

Now that you’ve done what you can with the currently available solutions and some extra measures where needed, it’s time to shelve this topic. But it’s important that you return to it later, in one year’s time. That’s because the world will have already changed, as will your risks and available solutions. Plan to go through these steps again, updating the map of IT components, data and data flows, reviewing your risks, checking whether there are new solutions available that fit your requirements, and so on.