Skip to content

ES³ Sovereignty Maturity Level (SML) Framework

Criteria Catalog for Measuring Digital Sovereignty of IT Services and Cloud Infrastructures

Executive Overview

Digital sovereignty enables organizations to walk away from the negotiating table at any time. This fundamental capability guarantees customers the complete freedom to terminate or migrate the use of an IT service without facing unacceptable technical, legal, operational, or supply chain risks and dependencies.

The ES³ Sovereignty Maturity Level (SML) Framework provides a standardized, evidence-based assessment engine designed to evaluate and verify the digital sovereignty of IT services and cloud infrastructures across nine distinct dimensions, including Artificial Intelligence (AI).

Core Premise

"Digital sovereignty is the ability to walk away from the table at any time."

Key Framework Principles

  1. Weakest-Link Principle
    Digital sovereignty is only as strong as its weakest link. A service's overall Sovereignty Maturity Level always corresponds to the lowest level achieved across all nine dimensions. Superior security or contract terms cannot compensate for a missing mandatory technical or legal control.

  2. Evidence-Based Verification
    Every assessment is strictly grounded in verifiable proof—such as contracts, architecture diagrams, system logs, audit reports, or cryptographic key configurations. Pure self-declarations or undocumented statements are rejected.

  3. Structured Transformation Pathway
    Sovereignty is measured along a four-tier maturity curve (Initial, Managed, Advanced, Future-Proof), giving organizations a practical roadmap to systematically reduce third-party dependencies over time.

Framework Architecture at a Glance

The framework evaluates services through a hierarchical data model:

Dimension → Control Objective → Control → Question → Evidence

  • 9 Structural Dimensions: From Strategic Sovereignty (SML 1) to Artificial Intelligence (SML 9).
  • 3 Implementation Levels: Contractual, Governance & Operations, and Technical measures.
  • 3 Control Scopes: Client-Facing Services (CFS), Service Providers (SP), and Underlying Services (US).

Metadata & Publisher Information

  • Publisher: Institute for Cyber Security and Digital Sovereignty | Schwarz Digits
  • Content Leadership: Sofie Schönborn (Digital Sovereignty Manager), Jo-Ann Sophie Gosemann (ES³ Program Lead and Complex Deals Lead)
  • Contact: ES3@digits.schwarz
  • Status: Version of July 2026