In this article, you will learn exactly what the Fundaments Sovereign Cloud entails and how we, together with our partners, implement the Sovereign Cloud Framework.
Fundaments achieved VMware Sovereign Cloud status in 2022. This status demonstrates that Fundaments is taking cloud sovereignty to the next level. It means we are committed to ensuring data protection and compliance, while adhering to national laws and regulations and protecting all cloud data against increasing digital threats. We achieve this by continuously striving to improve control over where data resides.
We help our partners on their journey toward optimal data continuity and security through our Sovereign Cloud Framework. In this article, you will learn exactly what the Fundaments Sovereign Cloud entails and how we implement this framework with our partners.
What is the Fundaments Sovereign Cloud?
With our sovereign Fundaments Cloud, we offer our partners the most secure and reliable cloud foundation. Looking at the Fundaments Cloud, we operate it independently and have everything from A to Z under control: from people to processes and technology. This starts with how we design a data center, through to how we ensure organizational continuity by selecting hardware, software, and their configurations. Furthermore, our skilled colleagues ensure that our daily management is held to the highest standard. How the cloud is consumed must be clear throughout the entire chain, and we are extremely critical of this. Continuity is the keyword here: business-critical applications must always be able to run without interruption. For instance, our data centers are geographically separated, and we exclusively use Dutch data centers. Additionally, both our organization and our data centers meet the relevant certifications regarding information security and continuity.
Sovereign Cloud Framework
Through the Sovereign Cloud Framework, we provide our partners with optimal data continuity and security. As shown below, this framework includes several steps we take to ensure data lands in the right place, in the right cloud, with the right measures to guarantee availability and continuity.
Step 1: in this first step, we assess whether we understand our client and focus on the requested specialty. Do we have the in-house expertise? Many organizations operate within specific market segments. For Fundaments, this means the organizations we help have needs and requirements that we can fulfill with our solutions. For example, hosting issues for application developers and management issues for applications requiring a local data center are our specialty.
Step 2: next, we hold a discussion with the Data Officer, Security Officer, and CISO. What policies are followed, and which parties are involved in managing the applications? By mapping out the total governance on the client side, Fundaments and its management organization can fully vouch for the processing of data landing on a platform. If this is not entirely possible, clarifying the demarcation of responsibilities and risks is also part of this step.
Step 3: in this third step, it is important to examine all data and how it is classified. Think of classifications such as 'public', 'internal', 'confidential', or 'secret'. Additionally, a classification can be made based on the impact on business processes: if data is unavailable, what is the impact on the organization? Also: what happens if data falls into the wrong hands? All these characteristics are identified in this step.
Step 4: based on the data classification from the previous step and, crucially, the policies regarding data management, this fourth step involves an analysis of where data may be stored and processed. Step 5: besides storing data and knowing its value through classification, it is important to know who processes the data and how. Who is the exact management organization protecting the data and ensuring its availability? Which individuals work with the data, and which processes ensure proper handling? By establishing the management organization and determining the jurisdiction in which it operates, a risk profile can be established.
Step 6: this step examines how continuous compliance is ensured. Protecting and maintaining the availability of data is an ongoing process that must always receive attention within a Deming cycle. This is covered in many certifications. For Fundaments, this is made transparent through reports on our process improvements, including our ISAE3402 Type I and II statements. Policies on innovation, research into product security, and improving knowledge through employee training also fall under this part of the framework. Step 7: all previous steps reveal which cloud can be chosen. For public data, a hyperscaler may be a solution, but for government applications, it must be clear throughout the entire chain where data is hosted and who processes it. Technical requirements can also play a role here; consider the physical distance between the user and the processing of their data. Fundaments also looks closely at data portability between clouds; especially when an exit strategy is explicitly desired, the migration to and from a cloud is examined in detail. Step 8: with the growth and dependency on data, protection and availability are requirements, but the set of applications and the underlying platform are also constantly changing. Keeping up with developments is an important part of this, especially because security methods are becoming increasingly diverse and robust. The chosen cloud platform must be able to facilitate this.
"Nowadays, making data available and protecting it online is the central issue; the cloud is a means to that end, not the goal itself." Larik-Jan Verschuren - CTO at Fundaments.
By going through the framework, all relevant matters for your data are mapped out. With the Fundaments sovereign cloud platform, you can find all the ingredients to make the right choices. Furthermore, the Fundaments Cloud Experts provide a solid, well-reasoned strategy for your business-critical data.
