12.11.2026 | Reading time: 7 minutes

Series: "Digital Sovereignty in Practice" Part 2 of 3

Secure Does Not Mean Sovereign What C5, EU CSF, C3A, SecNumCloud & CADA Measure, And Where Their Limits Lie

In the first part of this series, we sorted the jungle of sovereignty frameworks using four questions: Is a cloud service secure? How independent is it of countries outside the EU? Which provider is permitted for what? And how well does your own organisation control its dependencies? Part 2 addresses the first three questions, and with them the instruments that assess the provider.

Figure 1: For reference – the map from Part 1. This part covers questions 1 to 3.

Question 1: Security, the foundation

C5: The BSI classic

The Cloud Computing Compliance Criteria Catalogue (C5) has been the German reference standard for years. Auditors check against ISAE 3000 whether a cloud provider meets the criteria. A Type 1 attestation confirms that the controls are appropriately designed as of a specific date. Type 2 additionally confirms that they have actually operated effectively over a period, usually six to twelve months. In healthcare, C5 is a statutory requirement (Section 393 SGB V), in public administration it is the de facto standard, and banks frequently use it as evidence in third-party risk management under DORA. C5:2026 has been available since spring 2026, with new criteria on supply chains, post-quantum cryptography and the handling of requests from authorities, among other things. From mid-2027, audits will be carried out only against the new version.

What matters is what C5 does not say: a C5 attestation proves security, not independence. Even a US hyperscaler can present a flawless attestation; the AWS European Sovereign Cloud, for example, reported a C5 attestation just a few weeks after its launch. Whether a foreign authority could compel access in an emergency is a question C5 does not answer.

EUCS: Blocked

The European Cybersecurity Certification Scheme for Cloud Services (EUCS) was actually meant to close this gap across the EU. The EU Agency for Cybersecurity, ENISA, has been working on it since 2020. One question was particularly contentious: should the highest level also include sovereignty requirements, that is, an EU headquarters, European majority owners and protection from third-country law? France, Germany, Italy and Spain were in favour; the Netherlands, Ireland, Sweden and other states were against. In 2024, the requirements were removed from the draft. The scheme has still not been adopted.

This is the heart of the first question: because the member states could not agree to regulate sovereignty in a security certificate, the issue was moved elsewhere, and that is precisely why separate sovereignty frameworks exist today. The European Commission is now trying to break the deadlock from two sides. The revision of the Cybersecurity Act proposed in January 2026 is intended to make "non-technical risks", such as geopolitical dependencies, certifiable as well. And for its highest sovereignty level, Level 4, the draft CADA requires a European cybersecurity certificate at assurance level "high", a certificate that does not yet exist for cloud services because there is no EUCS. More on the four CADA levels under Question 3.

Question 2: Measuring Sovereignty

EU CSF: How the European Commission awarded 180 million euros

How do you measure something as political as sovereignty? In autumn 2025, the European Commission needed an answer, and one that would also withstand legal scrutiny: it wanted to award 180 million euros over six years to up to four cloud providers. The result is the Cloud Sovereignty Framework (EU CSF). It is not a law but a procurement tool, and that is precisely what makes it so practical. The framework has three levels:

8 sovereignty objectives (SOV-1 to SOV-8): strategic, legal and jurisdictional, data and AI, operational, supply chain, technology, security and compliance, environmental sustainability.
48 criteria, distributed across these eight objectives. Each criterion is a question with three to five answer levels, which are ticked like in a multiple-choice test. Example SOV-1-1, control over the legal entity: from "entirely outside the EU" to "entirely within the EU".
Two values per answer: Each answer level is assigned a SEAL value and a score.

SEAL stands for Sovereignty Effectiveness Assurance Level and ranges from SEAL-0 (no sovereignty) to SEAL-4 (full digital sovereignty).

Figure 2: The five SEAL levels of the EU Cloud Sovereignty Framework – and where the providers in the EU tender currently stand.

The scoring rule is crucial. You can think of it as a chain that is only as strong as its weakest link: the weakest criterion determines a target’s SEAL score, and the weakest target determines the overall SEAL score. A tenderer may excel in 47 criteria – but if they score SEAL-1 in just one, their overall rating is SEAL-1. For its tender, the Commission set SEAL-2 as the minimum standard. Anyone who fell below this in even a single criterion was eliminated.

Figure 3: How the SEAL score is calculated – the weakest criterion determines the target, and the weakest target determines the overall rating (example values).

The Sovereignty Score then distinguishes between providers that achieve the same SEAL score. The scoring logic in the Commission’s official assessment calculator is simple: each target is worth 1,000 points, distributed evenly across its criteria. SOV-1 has eight criteria, meaning 125 points per criterion. Within a criterion, the first response level always represents 0 per cent and the last 100 per cent, with the points distributed evenly in between – so, for four levels, this amounts to 0, 33, 67 and 100 per cent. Finally, the eight criteria are weighted and added together to produce an overall score.

Figure 4: The scoring logic and reference weights from the Commission’s evaluation calculator (June 2026). Contracting authorities may adjust the points and weights.

‘Allowed to take part’ is not the same as ‘performs better’

The elegance of the EU CSF lies in the separation of two distinct issues. The SEAL score determines who is even allowed to take part. The score determines who performs better.

This is precisely what makes the framework valuable for businesses too. Anyone drawing up a tender can set their red lines as a minimum SEAL score and express their priorities through weightings and points. Those who do not do so leave it up to the bidders to define what ‘superior’ means.

And what was the outcome of the tender? On 17 April 2026, the European Commission announced four successful bidders. Post Telecom (in partnership with OVHcloud and Clever Cloud), STACKIT and Scaleway each achieved SEAL-3. The consortium led by Proximus, which relies, amongst other things, on S3NS – a joint venture between Thales and Google – was awarded SEAL-2. No one achieved SEAL-4. Even the selected European providers are therefore not ‘fully sovereign’ by this standard, as chips, parts of the software and supply chains are not entirely European. Sovereignty is a spectrum, not a label.

C3A: The verifiable German response

Ten days after the contracts were awarded, on 27 April 2026, the BSI published C3A – Criteria enabling Cloud Computing Autonomy. With this, Germany has produced a verifiable version of the European sovereignty objectives.

C3A adopts the structure of the EU CSF and translates the objectives SOV-1 to SOV-6 into verifiable criteria. The key difference is that there are no levels. Each criterion is either met or not met. Instead, there are basic and additional criteria, some with variants, from which customers can choose depending on the use case – for example, EU or German jurisdiction. C3A deliberately leaves SOV-7 to the C5, which is a prerequisite. SOV-8, environmental sustainability, does not fall within the remit of the BSI. C3A is still a catalogue of criteria. Assessments are to be carried out via the established C5 process, and the first certificates are expected.

As a rule of thumb: C5 asks ‘Is the cloud secure?’. C3A asks ‘Is the cloud sovereign?’.

Figure 5: The EU CSF and BSI catalogues use the same objectives – C3A assesses SOV-1 to SOV-6, whilst C5 assesses the security component SOV-7.

SecNumCloud 3.2: France tightens the rules

France has gone a step further – and is taking a stricter approach. SecNumCloud 3.2, issued by the French cyber security agency ANSSI, is a government qualification, not merely a certification. It combines in a single credential what is split between C5 and C3A in Germany: technical security and protection against non-European law. The barriers to entry are high. Non-EU shareholders may hold no more than 24 per cent individually and no more than 39 per cent collectively, without veto rights. The company’s registered office, decision-making and operations must be based in the EU. SecNumCloud is now a legal requirement for sensitive data held by the French state.

Those that have been certified include OVHcloud, Outscale, Cloud Temple, Oodrive, Worldline and Orange. S3NS was added in December 2025, and NumSpot in September 2026. Bleu, the joint venture between Orange and Capgemini based on Microsoft technology, and Scaleway are still undergoing the certification process.

The same provider, two assessments

S3NS is SecNumCloud-certified, meaning it is protected from US access according to French standards. In the EU assessment, however, the consortium’s S3NS solution was classified as SEAL-2. Is this a contradiction?

No. SecNumCloud primarily assesses who is legally authorised to access the system. The EU CSF also examines how dependent the technology itself is – for example, what happens if the technology supplier stops providing updates. Anyone who fails to distinguish between these levels is comparing apples with pears and is easily misled by the label ‘sovereign’.

Question 3: Obligation

CADA: The legislator draws the line

Everything described so far is either voluntary or a procurement tool. The Cloud and AI Development Act (CADA) changes that. The European Commission presented the draft regulation on 3 June 2026 as part of its Tech Sovereignty Package. CADA has two objectives: data centre capacity in the EU is to triple within five to seven years. And the law will specify which cloud services the public sector is permitted to use for what purposes – via four sovereignty levels, the ‘Union Assurance Levels’.

Figure 6: The four stages of the CADA draft and the articles that may be relevant to businesses.

Initially, CADA will apply to the public sector. Public authorities must procure at least Level 1. For activities relating to public order – which also include the NIS2 sectors – Levels 2 to 4 are mandatory. For businesses, Article 31 is particularly relevant: under this, businesses in the particularly critical NIS2 sectors, including banks, may carry out voluntary assessments. However, the Commission may, by means of a delegated act, make this assessment mandatory for highly critical sectors.

The aim is to reach a political agreement by the end of 2027, and CADA is likely to be applied from 2029 at the earliest. So why think about it now? Because experience shows that such levels quickly become the market standard. Providers are then likely to advertise ‘CADA Level 3’, just as they currently advertise C5. And anyone signing cloud contracts today with terms of five to seven years is doing so for precisely the period during which CADA will apply.

It is important to make a distinction here: CADA levels and SEAL levels are not the same thing. The logic is similar, but the systems are separate – the CADA draft makes no reference to SEAL.

What already applies today

Alongside what is yet to come, some regulatory frameworks are already raising issues of sovereignty today, without actually using the word:

Since January 2025, DORA has required the financial sector to implement strict management of third-party ICT providers, including information registers and exit strategies. Since November 2025, 19 critical ICT service providers have been subject to direct European supervision, including AWS, Google Cloud and Microsoft. The ECB followed suit in July 2025: its guidance on cloud outsourcing requires exit plans to be in place even before go-live, as well as an assessment of geopolitical risks.
NIS2 has been in force in Germany since December 2025 and makes cybersecurity the personal responsibility of senior management.
The Data Act is an often underestimated tool for safeguarding sovereignty. Since September 2025, customers have had the right to switch providers within fixed timeframes; from 12 January 2027, providers will no longer be permitted to charge switching fees. This transforms switching from a theoretical to a practical option.

Dies ist ein blau eingefärbtes Bild von Architektur.

Eine Unternehmensberaterin steht neben einem Kollegen am Schreibtisch.

Get advice now

Interim Conclusion and Outlook

The tools covered in the first three questions have one thing in common: they assess the provider. C5 demonstrates security, whilst EU CSF, C3A and SecNumCloud make sovereignty measurable; CADA and existing regulations set the framework.

They do not answer the question of how sovereign an organisation can actually be. That is what the third and final part of the series is about: taking a look in the mirror with the IRN – and asking what all this means for your organisation.

More about our Competence Center IT Management

Share this post: