+Criteria enabling Cloud Computing Autonomy (C3A)
---+1 Introduction
------+1.1 Cloud Computing and digital sovereignty
------+1.2 EU Cloud Sovereignty Framework and BSI C5:2026 as the C3A foundation
------+1.3 Structure
------+1.4 Terms of Use
------+1.5 Definitions
---+2 Criteria, Additional Criteria and Supplementary Information
------+SOV-1 Strategic Sovereignty
---------+SOV-1-01 Jurisdiction
------------+SOV-1-01-C1
------------+SOV-1-01-C2
------------+SOV-1-01-SI
---------+SOV-1-02 Registered Office
------------+SOV-1-02-C1
------------+SOV-1-02-C2
------------+SOV-1-02-SI
---------+SOV-1-03 CSP Effective Control
------------+SOV-1-03-C1
------------+SOV-1-03-C2
------------+SOV-1-03-SI
---------+SOV-1-04 CSP Control Change
------------+SOV-1-04-C
------+SOV-2 Legal & Jurisdictional Sovereignty
---------+SOV-2-01 Extraterritorial Exposure
------------+SOV-2-01-C
---------+SOV-2-02 Audit Rights
------------+SOV-2-02-C1
------------+SOV-2-02-C2
------------+SOV-2-02-SI
---------+SOV-2-03 State of Defense Takeover
------------+SOV-2-03-C1
------------+SOV-2-03-C2
------------+SOV-2-03-SI
------+SOV-3 Data Sovereignty
---------+SOV-3-01 Data Residence
------------+SOV-3-01-C1
------------+SOV-3-01-C2
------------+SOV-3-01-C3
------------+SOV-3-01-C4
------------+SOV-3-01-C5
------------+SOV-3-01-SI
---------+SOV-3-02 External Key Management
------------+SOV-3-02-C
------------+SOV-3-02-AC
------------+SOV-3-02-SI
---------+SOV-3-03 External Identity Provider
------------+SOV-3-03-C
------------+SOV-3-03-AC1
------------+SOV-3-03-AC2
------------+SOV-3-03-AC3
---------+SOV-3-04 Logging and Monitoring
------------+SOV-3-04-C
------------+SOV-3-04-AC1
------------+SOV-3-04-AC2
---------+SOV-3-05 Client-Side Encryption
------------+SOV-3-05-C
------------+SOV-3-05-SI
------+SOV-4 Operational Sovereignty
---------+SOV-4-01 Operating Personnel
------------+SOV-4-01-C1
------------+SOV-4-01-C2
------------+SOV-4-01-C3
---------+SOV-4-02 Remote Work
------------+SOV-4-02-C1
------------+SOV-4-02-C2
---------+SOV-4-03 Redundant connectivity providers
------------+SOV-4-03-C
------------+SOV-4-03-AC
---------+SOV-4-04 SOC
------------+SOV-4-04-C1
------------+SOV-4-04-C2
---------+SOV-4-05 Ingress Data Control
------------+SOV-4-05-C
------------+SOV-4-05-AC1
------------+SOV-4-05-AC2
------------+SOV-4-05-SI
---------+SOV-4-06 Update threat analysis
------------+SOV-4-06-C
---------+SOV-4-07 Data exchange monitoring
------------+SOV-4-07-C
------------+SOV-4-07-SI
---------+SOV-4-08 Data exchange gateways
------------+SOV-4-08-C
------------+SOV-4-08-AC
------------+SOV-4-08-SI
---------+SOV-4-09 Disconnect
------------+SOV-4-09-C
------------+SOV-4-09-AC
------------+SOV-4-09-SI
---------+SOV-4-10 Reconnect
------------+SOV-4-10-C
------+SOV-5 Supply Chain Sovereignty
---------+SOV-5-01 Software Dependencies
------------+SOV-5-01-C
------------+SOV-5-01-AC
------------+SOV-5-01-SI
---------+SOV-5-02 Hardware Dependencies
------------+SOV-5-02-C
------------+SOV-5-02-AC
------------+SOV-5-02-SI
---------+SOV-5-03 External Service Dependencies
------------+SOV-5-03-C
------------+SOV-5-03-AC
------------+SOV-5-03-SI
---------+SOV-5-04 Export Restriction
------------+SOV-5-04-C
---------+SOV-5-05 Capacity Management
------------+SOV-5-05-C1
------------+SOV-5-05-C2
------+SOV-6 Technology Sovereignty
---------+SOV-6-01 Source Code Availability
------------+SOV-6-01-C
---------+SOV-6-02 Continuous Service Delivery
------------+SOV-6-02-C
------------+SOV-6-02-AC
---------+SOV-6-03 Software Development
------------+SOV-6-03-C

Criteria enabling Cloud Computing Autonomy (C3A)

Version v1.0, 2026-04-27

1. Panoramica

Titolo	Standard
1 Introduction
2 Criteria, Additional Criteria and Supplementary Information
SOV-1 Strategic Sovereignty
SOV-2 Legal & Jurisdictional Sovereignty
SOV-3 Data Sovereignty
SOV-4 Operational Sovereignty
SOV-5 Supply Chain Sovereignty
SOV-6 Technology Sovereignty

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti
Fonte	Requisito

3. Regolamentazioni correlate

Regolamentazioni
Fonte	Regolamentazione

Ticket collegati

Collegamenti
Tipo di collegamento	Ticket
is related to	German
is related to	English
is related to	Germany

BSI -
EN: Publications of the Bundesamt für Sicherheit in der Informationstechnik (BSI, Federal Office for Information Security), https://www.bsi.bund.de/. This is not an official BSI website. Only the versions published by the BSI are authoritative.
- Cloud Computing Compliance Criteria Catalogue C5:2026: © BSI, licensed under CC BY-ND 4.0; content unchanged, converted into the GRCA format.
- Criteria Catalogue C3A – Criteria enabling Cloud Computing Autonomy: © BSI, licensed under CC BY-ND 4.0; content unchanged, converted into the GRCA format.
- Cloud Computing Compliance Criteria Catalogue C5:2020: © BSI, licensed under CC BY 4.0 according to the BSI C5 FAQ; converted into the GRCA format.
DE: Veröffentlichungen des Bundesamts für Sicherheit in der Informationstechnik (BSI), https://www.bsi.bund.de/. Kein amtlicher Auftritt des BSI. Maßgeblich sind allein die vom BSI veröffentlichten Fassungen.
- Kriterienkatalog Cloud Computing C5:2026, englische Fassung: © BSI, lizenziert unter CC BY-ND 4.0; Inhalt unverändert, in das GRCA-Format umgewandelt.
- Kriterienkatalog C3A – Criteria enabling Cloud Computing Autonomy: © BSI, lizenziert unter CC BY-ND 4.0; Inhalt unverändert, in das GRCA-Format umgewandelt.
- Kriterienkatalog Cloud Computing C5:2020, englische Fassung: © BSI, lizenziert unter CC BY 4.0 laut C5-FAQ des BSI; in das GRCA-Format umgewandelt.