Refining Cloud routes to protect your data

Data protection is of great importance. Currently, NIS2 (the Network and Information Security directive) is a hot topic and is being widely discussed in the media. The government has drafted a successor to the initial NIS directive, designed to raise the general level of cybersecurity in the EU. When we view this in the context of Cloud routes, we see a new element that determines the choice of a Cloud platform: regulation and legislation. We also see an interplay between classification and regulation. In this article, we explain this further.

‍
In last week's article we saw that due to growing data volumes, it is necessary to categorize data based on its value; this is what we call data classification. A number of classifications have been established:

1. Public data: general information that is publicly available to everyone and poses no security threat. This includes, for example, data on an organization's LinkedIn page, press releases, and other generic information.

2. Internal data: data intended for internal use only. Although it does not contain confidential information, this data could still be harmful if it falls into the wrong hands. Think of internal email correspondence or project documents.

3. Confidential data: this is data containing highly sensitive, business-critical information. This may include customer information, contracts, or employee data.

4. Secret data: extremely confidential data that could cause irreparable damage to a company if it falls into the wrong hands, such as business plans or information regarding an upcoming acquisition.

This classification creates a need to impose a certain level of protection, with the government also providing guidance through regulation and legislation. NIS2 is a directive and does not dictate the specific setup of a Cloud environment, but it does require that measures be taken to adequately protect data, thereby forcing organizations to consider their security measures.

One of these measures is the choice of a Cloud platform. Regulations and classifications lead to requirements that determine the direction of the solution; consider elements such as data residency (where can data be stored?) and which certifications describe the right set of measures to provide sufficient protection for a specific data class/classification.

An example of this is shown in the figure below:

‍

In conclusion, we see an interplay between data classification and regulation regarding measures (whether from the government or from a standards framework/certification). This involves components such as data residency, compliance with legislation, and data protection and confidentiality. The chosen platform must therefore align with these. By taking these components into account, a smart sovereign Cloud strategy is created, where the requirements from data classification align with the Cloud platform. One such Cloud platform is the sovereign Cloud, as offered by Fundaments. We will discuss all components of that sovereign Cloud in our next blog, where we will further explain this Cloud route using the Sovereign Cloud Framework.