Digital Sovereignty: Who Really Has Administrative Access to Your Systems?
"EU-Service" sounds reassuring. Until the critical question is asked: Who actually has administrative access to your systems – really? Not on paper, not in the contract, but actually, in practice, with concrete ability to act?
This question is uncomfortable. It often leads to surprising answers. And it is at the core of what digital sovereignty means for mid-market companies.
Sovereignty Starts with the Supply Chain
Choosing an EU provider is an important first step. But it is not sufficient. Because behind the contractual partner lie sub-contractors, support partners, tool providers, and platform operators – often from third countries, often with their own access to systems and data.
Digital sovereignty does not just examine the direct contractual partner. It examines the entire supply chain. This is uncomfortable because it requires transparency that many providers do not deliver voluntarily. And it is necessary because compliance requirements such as NIS-2 and DORA demand exactly this depth of scrutiny.
Transparency as the Minimum Standard
A clear position holds that transparency is not an add-on. Transparency is the minimum standard. Concretely, this means: every service provider with access to critical systems must be able to explain who accesses those systems, when, and how – and document this in a traceable manner.
This is not an excessive demand. It is the basic prerequisite for a robust security architecture. And it is precisely what is asked during a NIS-2 audit or security review.
Four Audit Questions for IT Decision-Makers
From practical experience, four questions have proven effective when evaluating cloud and managed service providers. First: Where are operations and support located – including on-call service? Just because a provider has an EU headquarters does not mean night support is in Europe. Second: How are admin accesses managed? Are they time-limited, subject to approval, and fully logged? Third: Which sub-contractors are involved, and for what tasks? "I don't know" is not an acceptable answer. Fourth: How are changes tracked – in configurations, accesses, and processes?
These four questions cover the core area where digital sovereignty is either real or remains merely a marketing message.
Practical Implications for Vendor Management
The answers to these questions should be contractually anchored, regularly reviewed, and documented as part of the ISMS. This is not additional bureaucracy – it is the foundation of a vendor management structure that is NIS-2 ready.
For many mid-market companies, this means a structured analysis of their existing vendor landscape: Who has access? Under what conditions? What happens in the event of an incident involving the service provider? Do we have exit paths?
Conclusion: Sovereignty Is a Governance Question
Digital sovereignty is not only a technical question. It is primarily a governance question. It requires clear criteria in vendor selection, contractual transparency requirements, and regular review of actual access conditions.
Those who consistently ask the four audit questions – for every new provider but also for existing ones – build sovereignty systematically. And thereby create the foundation for a compliance architecture that will hold up under scrutiny.