Digital Sovereignty: 20 Questions to Get Started

Use the checklist effectively

Choose the organisation, a department or an important process as the scope. Involve IT, business owners and, where needed, procurement, information security and data protection. A tick means the question is answered with traceable evidence. An unticked box identifies an issue to clarify, rather than an automatic judgement on the quality of your IT.

Discuss each question: what is evidenced? What remains open? Who will take the next step? The number of ticks is neither a maturity score nor evidence of legal compliance. Entries are not transmitted or stored permanently. You can print the page for your records.

For a more detailed assessment of an individual provider, a supplementary guide offers 25 questions.

Dependencies and Freedom to Act

• 1. Do we know our organisation’s most important technical and contractual dependencies?
• 2. Can we switch key providers with reasonable technical, contractual and organisational effort?
• 3. Do we have enough in-house knowledge to understand and assess important solutions and manage their operation?
• 4. Can we clearly define requirements for security, data protection, availability and operations, and communicate them to providers?
• 5. Is it clear who may access important data and who controls access?

Data and Cloud

• 6. Can important data be exported in full, in documented and reusable formats?
• 7. Are relevant interfaces documented and usable by other solutions?
• 8. Are cloud decisions made jointly, based on protection needs, responsibilities and operational requirements?
• 9. Have we tested the portability of important cloud data, configurations and applications in practice?
• 10. Do we understand dependencies relating to identities, collaboration, databases, AI and virtualisation?

Technology and Requirements

• 11. Do we assess open standards and open-source alternatives against our specific requirements?
• 12. Have we established which legal and contractual requirements apply to our organisation and the service under review?
• 13. Are the purpose, limitations, risks and responsibilities of AI use clearly documented?
• 14. Are responsibilities and decision-making processes defined for IT, data and residual risks?
• 15. Do we have tested or realistically planned procedures for provider switching, migration and emergencies?

Collaboration and Implementation

• 16. Do business teams, procurement, architecture and operations align their requirements and decisions?
• 17. Do we identify and reduce unnecessary data and application silos?
• 18. Do new solutions account for integration with existing systems and opportunities for reuse?
• 19. Are there prioritised actions with owners, realistic deadlines and verifiable outcomes?
• 20. Can findings and decisions be communicated clearly to internal and authorised external stakeholders?

Turn outstanding questions into next steps

Select the open issues with the greatest impact on an important process. Distinguish missing information from confirmed weaknesses. Initially, each priority question needs only a clear next step, an owner and a deadline.

For a specific provider decision, the detailed guide offers an evidence checklist and decision template. Where several areas are involved, a joint assessment can help determine the order of actions.

Continue with a specific case

Use the overview to examine an important dependency in greater detail. Autonomy Track connects the assessment with evidence and over 190 action templates for implementation.