Openers · Digital Sovereignty Risk Review
Know where vendors and regulators decide for you – and what to do about it.
Dependency-risk management, not ideology and not a migration project. People from IT, procurement, legal and the business answer and challenge each other first; the report shows where the risk really sits.
- ForCIO, CTO, CFO, legal and procurement
- The questionWhere do you control your data and systems?
- You decidereduce, transfer, avoid or accept each risk
- Nextmitigation strategy, only on request
Sounds familiar?
Everyone sees a different part of the same dependency.
“What happens if our cloud provider changes its terms?”
“IT, legal and procurement each tell a different story.”
“Could we switch providers – and what would make that hard?”
What you get
A decision-oriented report your board can read.
Executive summary
What leadership needs to understand and consider next.
Initial RAID log
Risks, decisions already made, current issues and dependencies in one view.
Recommended next steps
With suggested owners, priorities and indicative time horizons.
What it looks like
Disagreement is evidence, not noise.
Every topic shows how complete the input is and where the perspectives disagree. Missing information is made visible, not replaced with false certainty – and sector benchmarks are labelled as such.
| Type | Topic | Views | Priority |
|---|---|---|---|
| R | Cloud provider changes its terms – exit plan never tested | High | |
| D | E-mail stays with the current vendor – risk accepted | Recorded | |
| I | Nobody owns the export of backup data | Medium | |
| D | Payroll runs on one SaaS vendor with no data export | High |
Views: IT · legal · procurement – agrees, disagrees, no answer. An illustrative example.
How it works
Answers first, analysis second.
Week 0
Scope and an owner
Choose the option and the language; your owner coordinates participants.
Up to 2 weeks
Individual answers
Each role answers its own questions; “I don't know” is a valid answer.
Up to 1 week
Peer review
Participants comment on each other's answers – agree, question, add.
+5 business days
Report and review
Expert analysis, the report, and a findings review three days later.
Who should be involved
- an owner who coordinates
- IT and security
- finance and procurement
- legal
- business service owners
Price
One assessment, two ways to work together.
Lite
from €1,500
- Questionnaires per role, as PDF and Excel forms
- Peer review, expert analysis, report as a PDF
- Findings review, 30–45 minutes
- Paid upfront
Facilitated
from €5,000
- Everything in Lite
- Up to 2 hours of targeted sessions before the report
- Findings review, 45 minutes
- Paid when it's done
Next stages
on request
- Mitigation strategy
- Risk-reduction roadmap and program
- Sovereignty governance
For now the questionnaires come as PDF and Excel forms; a guided online tool is in the works. The windows are maximums, not waiting periods: finish earlier and the review moves earlier. Several business units? Each gets its own review, with an optional consolidated report.
Details
Digital sovereignty is not about replacing every foreign vendor. It is about understanding your dependencies and deliberately deciding which risks to reduce, transfer, avoid or accept.
Why this review
Your IT team, procurement, legal and business leaders each see a different part of the same dependency. The risk often sits between those perspectives.
- Who can access your data – technically and legally?
- Which vendors and platforms are critical to keeping the business running?
- What happens if a provider changes its terms, restricts a service or becomes unavailable?
- Could you change providers if you needed to – and what would make that hard?
- Where do regulatory obligations, customer expectations and your current setup fail to align?
What makes it different
We do not start with a workshop or rely on one person's answers. People from different parts of your organisation first complete a shared questionnaire tailored to their role, then review each other's answers – what they agree with, what they question, what is missing. Only then does the analysis start, so expert attention goes to the real gaps and conflicting assumptions instead of collecting basics. Disagreement is useful evidence; missing information is made visible, not replaced with false certainty.
What it does – and does not – establish
The report states how complete your input is and separates your organisation's information from sector benchmarks, assumptions and unknowns. It is not a legal opinion, a compliance certification, a full technical audit, a contract review or a migration-cost estimate.