Skip to content

Introduction

1.1 Digital Sovereignty

Digital sovereignty enables organizations to walk away from the negotiating table at any time. This fundamental capability guarantees customers the freedom to terminate or migrate the use of an IT service without unacceptable dependencies or risks. Securing this level of freedom demands a close look at three layers:

  1. Technological Sovereignty: Ensuring no vendor lock-in through open standards and flexible data portability.
  2. Operational Sovereignty: Maintaining business continuity and independent control over day-to-day operations.
  3. Legal Sovereignty: Providing full digital immunity and data protection against unauthorized or extraterritorial access.

1.2 SML Framework

The Sovereignty Maturity Level (SML) Framework is an auditable framework designed to assess the digital sovereignty of IT services across nine sovereignty dimensions, including Artificial Intelligence (AI). In this context, digital sovereignty is only as strong as its weakest link. This means that the overall SML always corresponds to the lowest level across all nine dimensions.

The framework follows three guiding principles:

  • Auditability: Assessment must be evidence-based, comprehensible, and reproducible.
  • SML classification: SMLs are assigned based on defined mandatory controls per level.
  • Comparability: Results should be comparable between services/providers and over time.

The SML Framework encompasses the structure of the assessment (Divisions, Control Objectives, Controls, Questions, Evidence) as well as the basic logic of the evidence-based evaluation. The SML classification is based on the assignment of controls to the Sovereignty Maturity Levels (Initial, Managed, Advanced, Future-Proof).

1.3 EU Cloud Sovereignty Framework (EU CSF) as the ES3 Foundation

The ES3 standard aligns with the EU Cloud Sovereignty Framework and adapts its eight strategic sovereignty objectives. The ES3 SML Framework operationalizes and expands these to include the ninth dimension, “Artificial Intelligence (AI)”.

1.4 Structure

The components of the SML framework are arranged in a hierarchical sequence:

Dimension → Control Objective → Control → Question → Evidence

Dimension: A Dimension describes a thematic area of digital sovereignty. It forms the highest structural level of the framework and groups multiple Control Objectives. It consists of Dimension ID, the Dimension and the Dimension Objective. It covers a strategic thematic area, aligns with EU digital sovereignty objectives, and is stable over a longer period of time.

Control Objective: A Control Objective describes a goal within a dimension that must be achieved to ensure digital sovereignty. It consists of Control Objective ID, Topic, Control Objective and the Sovereignty Contribution. It describes a Objective, is technologyneutral and is implemented through multiple controls.

Control: A Control ensures a structured a structured and comprehensive implementation of Control Objectives, Controls are organized along three implementation levels. They consist of: Control ID, Control Description, Control Level, Control Scope and Service Type. Controls cover a concrete measure, are implementable and auditable.
Each control is assigned to exactly one implementation level (Contractual, Governance and Operations, or Technical).

Question: Question is a binary audit question (“Yes,” “No,” or “N/A”) used to verify the implementation of a control. It consists of: Question ID and Question. Each question addresses exactly one requirement and is formulated in a way that is uniquely verifiable and derives a specific piece of evidence.

Evidence: Evidence is the proof used to substantiate an answer to a question. It must be specific, verifiable, and directly assignable to the control.

Permissible evidence types include:

  • Contracts or legal agreements
  • Policies and procedural documentation
  • Technical configurations or system extracts
  • Audit reports or certifications
  • Architecture diagrams

The evidence must enable an independent third party to fully comprehend the assessment.