---
title: Digital Sovereignty and CSF Alignment
description: Translate digital sovereignty goals and EU Cloud Sovereignty Framework expectations into architecture, controls, and evidence, with ES3 as a practical maturity extension.
sidebar:
  label: Digital Sovereignty, CSF, and ES3
  order: 15
source_url: "https://framework.stackit.cloud/migration/design-and-mobilize/security-and-compliance/digital-sovereignty-and-csf-alignment/"
source_file: "docs/migration/design-and-mobilize/security-and-compliance/digital-sovereignty-and-csf-alignment.mdx"
---

## Purpose

This module translates sovereignty requirements into practical architecture, governance, and evidence decisions for migration.

## Why sovereignty is a core migration requirement

- **Legal and regulatory exposure**: Data location, jurisdiction, and control transparency affect compliance outcomes.
- **Operational resilience**: Sovereign operating models reduce dependency and concentration risks.
- **Trust requirements**: Regulated sectors require measurable sovereignty controls and traceable evidence.

## Implementation model for the EU cloud sovereignty framework

Treat the EU Cloud Sovereignty Framework (CSF) as a structured requirement set and map it to migration controls:

- **Requirement interpretation**: Define applicable CSF expectations for data, operations, and control transparency.
- **Control mapping**: Map expectations to preventive, detective, and governance controls.
- **Evidence mapping**: Define telemetry, reports, and attestations that prove control implementation.
- **Maturity planning**: Implement in phases by workload criticality and risk.

## Practical extension for digital sovereignty and the EU cloud sovereignty framework

- **Strengthen measurement**: ES3 makes digital sovereignty measurable through the Sovereignty Maturity Level (SML) model.
- **Cover nine dimensions**: ES3 builds on the EU Cloud Sovereignty Framework (CSF) and adds an explicit AI dimension.
- **Apply the minimum principle**: The overall service level is constrained by the lowest maturity level across all dimensions.
- **Reinforce auditable evidence**: Evidence is assessed against objective criteria to support governance and assurance.

Further reading:

- **ES3 program overview**: <LinkChip href="https://stackit.com/de/warum-stackit/vorteile/es3">stackit.com</LinkChip>
- **ES3 one-pager**: <LinkChip href="https://stackit.com/de/asset/download/51397/file/One-Pager%2520ES3.pdf?version=2">stackit.com</LinkChip>

## STACKIT context links

- **Regions and data location**: <LinkChip href="https://docs.stackit.cloud/platform/regions/">Documentation</LinkChip>
- **Audit and assurance evidence context**: <LinkChip href="https://docs.stackit.cloud/platform/audit-log/">Documentation</LinkChip>
- **Identity and governance context**: <LinkChip href="https://docs.stackit.cloud/platform/access-and-identity/">Documentation</LinkChip>

## Anti-patterns to avoid

- **Sovereignty as claim only**: No measurable control and evidence mapping.
- **No CSF traceability**: Requirements are discussed but not linked to controls and ownership.
- **One-time assessment only**: Posture is not reviewed after architecture or regulatory changes.