The pros and cons of sovereign clouds

What is a sovereign cloud?

Traditional cloud services spread workloads, data storage and processing across available resources, sometimes in disparate locations. This dissemination of resource use is often deliberate, e.g., content delivery networks and edge computing. Cloud architecture does not follow national borders or jurisdictions.

Sovereign clouds confine services within a specified border to ensure compliance with local data privacy requirements. Even private cloud offerings, such as virtual private clouds, cannot necessarily provide the data protection and control of sovereign clouds. Private cloud offerings can dedicate hardware and services to customers, but do not guarantee the same boundary restrictions. Both approaches have a role in cloud computing, but their level of control over sensitive data differs.

Sovereign clouds offer greater control over data by ensuring the following:

• Data residency. Collection and storage of data occur within defined borders.
• Local sovereignty and privacy regulations. Sovereign clouds comply with regional laws where the cloud operates by default.
• Access control. Increased access control over data with less reliance on cloud providers that could be subject to another nation's data protection laws.
• Data security. Standard methods of protecting data apply, including encryption, key control and monitoring.

Sovereign cloud benefits for enterprises

Many organizations enjoy the control offered by sovereign clouds. While some organizations have moved data from a public cloud deployment to a private cloud or data center, these approaches might not meet specific legal requirements or operational needs. Consider what makes sovereign cloud the more attractive option.

Cloud's capabilities

Sovereign clouds provide the standard cloud benefits of scalability, disaster recovery, service availability, redundancy and flexibility. These features are especially enticing to businesses looking to increase cost savings and improve efficiency.

Greater control over data

Since sovereign clouds operate within defined national borders, users can be selective as to where, and with whom, their data resides. Sovereign clouds isolate operations, such as failover during disaster recovery, within a specific jurisdiction. Administration tools, consoles, configuration management interfaces, logging and monitoring services remain within set boundaries to ensure data in transit remains localized.

Simplified compliance

Industries such as technology, healthcare, aerospace and even the public sector require strict data privacy provisions that sovereign clouds can satisfy. Depending on the given service, providers build compliance features to suit government or industry requirements, and even contractual or business obligations mandated by certain laws or regulations.

Common challenges associated with sovereign clouds

Sovereign clouds are not without their challenges. Shifting from capital expenditures to operational expenses can be challenging. Safely and efficiently transferring data from on-premises to a cloud provider can also be difficult. Consider the following challenges around sovereign cloud computing.

Compatibility and availability concerns

One consideration is cloud service availability and compatibility within specific regions. Cloud service providers sometimes limit features or capabilities, such as languages, depending on the region. Increased restrictions and regulations could negatively affect compatibility across sets of applications.

Vendor lock-in

Limited service availability and compatibility mean fewer cloud service providers offer those services. This places organizations in the position of accepting vendor lock-in based on regional requirements. This reduces options in the future, especially as organizations explore multi-cloud architectures or change cloud service providers. A sovereign cloud customer unhappy with their provider's cost or support might not have much choice.

Increased costs

Cost is always a factor when dealing with digital sovereignty. Limited availability and vendor services could add costs. However, these fees are typically rolled into the cost of doing business in that region and meeting its privacy requirements.

Excessive government access

Data protection laws could provide governments with excessive access to sensitive data. Since sovereign cloud computing requires data to reside within specific legal jurisdictions, the related laws could give regulating bodies greater access than cloud service providers normally allow. This is especially apparent in government bodies that intrude on citizen privacy and activism.

Protecting data in transit

Though sovereign cloud descriptions focus on data-in-use and data-at-rest concerns, do not neglect data-in-transit privacy requirements. This topic is like data control in more standard public and multi-cloud deployments.

VPN connections and encryption practices such as HTTPS or IPsec are still necessary to mitigate eavesdropping and man-in-the-middle attacks. Cloud administrators must provide security for users in the office or at home. Services must also exist for administrative connections that deploy, maintain and monitor cloud infrastructure. Cloud service providers offer secure connectivity tools. Organizations must ensure those tools meet the legal requirements of the region hosting the sovereign cloud.

Sovereign cloud services

Major cloud providers understand the demand for sovereign clouds. Consider the following services from five leading cloud vendors based on IDC market research:

• AWS European Sovereign Cloud and GovCloud.
• Google Sovereign Cloud.
• IBM Cloud.
• Microsoft Cloud for Sovereignty.
• Oracle Government Cloud and EU Sovereign Cloud.

Google, IBM and Oracle are also verified partners with VMware and provide VMware technology and support in some of their services.

Begin investigating sovereign cloud services for your organization immediately, especially in international business contexts. Entities that ignore this trend risk legal and financial penalties -- a threat to doing business in specific parts of the world.

Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to TechTarget Editorial and CompTIA Blogs.