The push for digital sovereignty: What CISOs need to know

Digital sovereignty is on the rise

Governments around the world are implementing laws and regulations promoting digital sovereignty, a movement that has been bubbling up for a decade.

The idea of digital sovereignty stemmed in part from data privacy regulations and, more specifically, the EU's GDPR, which dictates how EU citizens' data must be treated by businesses and other entities, regardless of where those organizations are headquartered or operate.

Such regulations gave rise to data sovereignty, the concept that information generated, processed, converted and stored in digital form is subject to the laws of the country in which it was created.

Digital sovereignty moves the needle further. It goes beyond regulating data to regulating the digital infrastructure, innovation and investments purchased, made and used by organizations within a country or government jurisdiction. The model is designed to ensure some or all of those technology sectors are locally sourced and operated.

Drivers of digital sovereignty

Governments are pushing for digital sovereignty to ensure organizations within their borders are resilient and not vulnerable to actions taken by foreign governments that could limit access to or raise the cost of computer components or services, experts said.

"It's about being independent from foreign government jurisdictions and influences on your IT stack. That's it in a nutshell. It's about the IT stack being free from foreign jurisdictions, influences and decisions," said Dario Maisto, an analyst with Forrester.

It's about being independent from foreign government jurisdictions and influences on your IT stack.

Governments also believe enabling digital sovereignty will help cushion organizations within their jurisdictions against events such as wars and pandemics that disrupt global supply chains, experts said. Governments have seen how companies in recent years scrambled to find new service providers after economic sanctions, war and other political actions shut off existing offshore vendors -- a situation that some digital sovereignty laws aim to prevent in the future.

"We're hearing about digital sovereignty being about continuity and availability of services. As the geopolitical environment gets hotter, there is a growing awareness that events have knock-on effects, and there are cases where it's reasonable for governments to think about digital dependencies," said Alexander Botting, senior director of global security and technology strategy at law firm Venable LLP.

Economic considerations drive some digital sovereignty laws as well. "There are some cases that are about straight protectionism," Botting added.

Some governments are championing digital sovereignty as a way to boost their own economies, as well as to foster technology and AI innovations, thereby ensuring they don't become overly dependent on other countries' tech sectors.

Digital sovereignty laws reshape tech stack decisions, cloud deployments and vendor selection

The number of digital sovereignty laws is increasing, as is the number of countries implementing them, experts said.

The U.S., EU, Australia, India, China and Russia all have laws promoting some level of digital sovereignty. These laws vary widely in what they govern, so the impacts they can have on organizations, their tech decisions and their operations vary significantly, too. Considered collectively, the laws impact nearly every part of an organization's digital environment, from the providers it uses to the hardware it buys and where it stores its data.

"They really take data sovereignty to the next level to incorporate things like digital and tech operations. They can impact who is able to operate, administer and maintain the systems where the data resides, where the tools you're using have been created and what you use in your tech stack," Mellen explained. "It requires a lot of architectural decisions, especially if you're a multinational, in terms of how you create and service the products you're selling, but also the way you're operating the products and services you're acquiring. You might need hybrid or multi-cloud deployments, and it might change which vendors you will allow to do [what work] because they can't be used in certain regions."

Some laws make it harder or illegal to transfer data across national borders, experts noted. And some laws affect which cloud service providers organizations can use and where the CSPs' data centers must be located. They're also influencing which SaaS vendors, outsourced providers and hardware makers companies hire.

"Global companies now are going to have to be thinking about all this," said Sushila Nair, an independent information security consultant and president of the Greater Washington, D.C., chapter of ISACA.

Nair said CIOs, CISOs, chief risk officers, chief compliance officers and corporate counsel typically lead the efforts to comply with digital sovereignty requirements.

Preparing for digital sovereignty

Organizations are already adjusting their technology operations and IT strategies to meet existing laws and in anticipation of more to come, Forrester's Maisto said.

He noted that some organizations -- such as defense companies, those in highly regulated sectors and government/public sector entities -- fall under more of these digital sovereignty laws than other commercial enterprises. But he warned that more organizations across more sectors will face such requirements in the future.

To comply with this evolving regulatory environment, Maisto said Forrester advises tech leaders to aim for minimum viable sovereignty. Maisto wrote in a 2025 post that minimum viable sovereignty is "a pragmatic, risk-based approach that balances legal requirements, budget and business needs."

He said this approach recognizes that there is no single standard that defines digital sovereignty and that some technologies "you can't even have as sovereign" because few or no vendors make alternatives to the leading makers.

The approach promotes building "workloads that are portable, containerized using Kubernetes," so they can be moved from one CSP to another or even to on-premises environments.

Maisto said he also advises organizations to consider digital sovereignty as they evaluate their supply chain and operational risks, noting that it's critical for tech leaders to identify dependencies such as APIs. Furthermore, he advises tech leaders to consider how data sovereignty impacts six domains across the digital chain: data, which sits on infrastructure, that flows through networks, is leveraged by software, is used by AI, and is managed by people.

He noted that organizations generally can't achieve equal sovereignty across all six domains. "But there are certainly areas where there is objective sovereignty you can achieve," he said, adding that moving to even minimum viable sovereignty is a multiyear journey.

Mary K. Pratt is an award-winning freelance journalist with a focus on covering enterprise IT and cybersecurity management.