Cloud service (Ceren) - Revision history

Isiklar Ceren at 10:00, 23 September 2026

2026-09-23T10:00:52Z

← Older revision		Revision as of 12:00, 23 September 2026
Line 13:		Line 13:
	**Market trust, consumer protection, and national security through verified cloud security standards”		**Market trust, consumer protection, and national security through verified cloud security standards”
	*'''Weakness:''' Heavily dependent on the EU-level EUCS framework, where if that scheme is weak or delayed, the NCCA's certification work lacks a solid foundation.		*'''Weakness:''' Heavily dependent on the EU-level EUCS framework, where if that scheme is weak or delayed, the NCCA's certification work lacks a solid foundation.
	'''3. European Data Protection Board (EDPB) (~~EU —~~ public, supranational)~~'''~~		'''3. European Data Protection Board (EDPB) '''(public, supranational)
	*'''Source of authority:''' GDPR (Regulation 2016/679)		*'''Source of authority:''' GDPR (Regulation 2016/679)
	*'''Governing instrument:''' GDPR; EDPB Guidelines (e.g. Guidelines 01/2020 on processing personal data in cloud services)		*'''Governing instrument:''' GDPR; EDPB Guidelines (e.g. Guidelines 01/2020 on processing personal data in cloud services)

Isiklar Ceren at 09:59, 23 September 2026

2026-09-23T09:59:16Z

← Older revision		Revision as of 11:59, 23 September 2026
Line 1:		Line 1:
	<p>A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive. The governance mechanisms touched upon in this entry were fueled by a concern over sovereignty/jurisdiction. The data stored and transported through cloud services could be monitored by non-EU actors (namely US hyper scalers and through these the US government (e.g. Snowden revelations)), thereby potentially giving rise to the compromise of EU data. The race to govern through the below mentioned legal instruments and institutions aim to address sovereignty concerns.</p>		<p>A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive. The governance mechanisms touched upon in this entry were fueled by a concern over sovereignty/jurisdiction. The data stored and transported through cloud services could be monitored by non-EU actors (namely US hyper scalers and through these the US government (e.g. Snowden revelations)), thereby potentially giving rise to the compromise of EU data. The race to govern through the below mentioned legal instruments and institutions aim to address sovereignty concerns.</p>
	1. The European Union Agency for Cybersecurity~~'''~~ ''''''ENISA '''(public)		'''1. The European Union Agency for Cybersecurity ''''''ENISA '''(public)
	*'''Source of authority and Governing instrument:''' Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) [https://www.enisa.europa.eu/about-enisa/what-we-do empowers ENISA ]		*'''Source of authority and Governing instrument:''' Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) [https://www.enisa.europa.eu/about-enisa/what-we-do empowers ENISA ]
	*'''Interest/value:''' in the [https://www.enisa.europa.eu/sites/default/files/2026-05/ENISA%20NIS360%202026.pdf NIS360 report ] published by ENISA, it is stated that ENISA is “the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe” and that ENISA “contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges”.		*'''Interest/value:''' in the [https://www.enisa.europa.eu/sites/default/files/2026-05/ENISA%20NIS360%202026.pdf NIS360 report ] published by ENISA, it is stated that ENISA is “the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe” and that ENISA “contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges”.

Isiklar Ceren at 09:58, 23 September 2026

2026-09-23T09:58:54Z

Isiklar Ceren: Created page with "
A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive.
#''' '''The European Union Agency for Cybersecurity''' ''''''ENISA '''(public) *'''Source of authority and Governing instrument:''' Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) [htt..."

2026-09-22T20:18:40Z

Created page with "<p>A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive.</p> #''' '''The European Union Agency for Cybersecurity''' ''''''ENISA '''(public) *'''Source of authority and Governing instrument:''' Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) [htt..."

New page

<p>A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive.</p>
#''' '''The European Union Agency for Cybersecurity''' ''''''ENISA '''(public)

*'''Source of authority and Governing instrument:''' Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) [https://www.enisa.europa.eu/about-enisa/what-we-do empowers ENISA ]
*'''Interest/value:''' in the [https://www.enisa.europa.eu/sites/default/files/2026-05/ENISA%20NIS360%202026.pdf NIS360 report ] published by ENISA, it is stated that ENISA is “the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe” and that ENISA “contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges”.
*'''Weakness:''' ENISA's capacity to resist geopolitical and commercial pressure is being questioned, as US hyperscalers continue to dominate global cloud service markets

#''' National Cybersecurity Certification Authority of the Netherlands'''''' ''''''(Dutch NCCA) '''(public)

*'''Source of authority and Governing instrument:''' EU Cybersecurity Act (Article 58),  and the Dutch Cybersecurity Regulation Implementation Act which implemented the Cybersecurity Act nationally. This entity is the national cybersecurity certification authority int he Netherlands.
*'''Interest/value:''' as described on their [https://www.dutchncca.nl/about-the-ncca website], the NCAA has the following mandate:    

**“Oversee the issuing of EU cybersecurity certificates at the CSA’s assurance level High;
**Authorise Conformity Assessment Bodies (CABs) for the CSA certification schemes;
**Supervise certificates issued throughout the lifecycle of certified ICT products and services;
**Contribute on European level to the development and maintenance of CSA certification schemes.
**Market trust, consumer protection, and national security through verified cloud security standards” 
*'''Weakness:''' Heavily dependent on the EU-level EUCS framework, where if that scheme is weak or delayed, the NCCA's certification work lacks a solid foundation.

#''' European Data Protection Board (EDPB) (EU — public, supranational)'''

*'''Source of authority:''' GDPR (Regulation 2016/679)
*'''Governing instrument:''' GDPR; EDPB Guidelines (e.g. Guidelines 01/2020 on processing personal data in cloud services)
*'''Interest/value:''' Privacy and data protection; ensuring cloud providers processing EU personal data comply with fundamental rights obligations
*'''Weakness:''' Enforcement of the GDPR is left to national DPAs, which vary in resources and willingness to act (Ireland's DPA has been widely criticised for slow enforcement)

#''' Gaia X '''(non-state, international)

*'''Source of authority:''' Voluntary membership organisation
*'''Governing instrument:''' Gaia-X Trust Framework defines the minimum baseline to be part of the '''Gaia-X Ecosystem'''. This framework “provides a common governance and the basic level of interoperability across individual ecosystems”
*'''Interest/value:''' Gaia X [https://gaia-x.eu/about/ aims] to achieve digital sovereignty through innovation, and its [https://docs.gaia-x.eu/policy-rules-committee/compliance-document/3.1.0/Executive_Summary/ values] are “openness, transparency, data protection, security, and portability” 
*'''Weakness:''' Gaia-X was trying to build sovereign infrastructure in the EU market where non-European hyperscalers (Microsoft, Google, Amazon) already dominate (Plixavra Vogiatzoglou and Joris van Hoboken, 'The EU's Digital Sovereignty and Quantum Technologies: To What End?')

← Older revision		Revision as of 11:58, 23 September 2026
Line 1:		Line 1:
	<p>A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive.</p>		<p>A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive. The governance mechanisms touched upon in this entry were fueled by a concern over sovereignty/jurisdiction. The data stored and transported through cloud services could be monitored by non-EU actors (namely US hyper scalers and through these the US government (e.g. Snowden revelations)), thereby potentially giving rise to the compromise of EU data. The race to govern through the below mentioned legal instruments and institutions aim to address sovereignty concerns.</p>
	~~#''' '''~~The European Union Agency for Cybersecurity''' ''''''ENISA '''(public)		1. The European Union Agency for Cybersecurity''' ''''''ENISA '''(public)

	*'''Source of authority and Governing instrument:''' Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) [https://www.enisa.europa.eu/about-enisa/what-we-do empowers ENISA ]		*'''Source of authority and Governing instrument:''' Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) [https://www.enisa.europa.eu/about-enisa/what-we-do empowers ENISA ]
	*'''Interest/value:''' in the [https://www.enisa.europa.eu/sites/default/files/2026-05/ENISA%20NIS360%202026.pdf NIS360 report ] published by ENISA, it is stated that ENISA is “the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe” and that ENISA “contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges”.		*'''Interest/value:''' in the [https://www.enisa.europa.eu/sites/default/files/2026-05/ENISA%20NIS360%202026.pdf NIS360 report ] published by ENISA, it is stated that ENISA is “the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe” and that ENISA “contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges”.
	*'''Weakness:''' ENISA's capacity to resist geopolitical and commercial pressure is being questioned, as US hyperscalers continue to dominate global cloud service markets		*'''Weakness:''' ENISA's capacity to resist geopolitical and commercial pressure is being questioned, as US hyperscalers continue to dominate global cloud service markets
			'''2. National Cybersecurity Certification Authority of the Netherlands'''''' ''''''(Dutch NCCA) '''(public)
	#''' National Cybersecurity Certification Authority of the Netherlands'''''' ''''''(Dutch NCCA) '''(public)

	*'''Source of authority and Governing instrument:''' EU Cybersecurity Act (Article 58),  and the Dutch Cybersecurity Regulation Implementation Act which implemented the Cybersecurity Act nationally. This entity is the national cybersecurity certification authority int he Netherlands.		*'''Source of authority and Governing instrument:''' EU Cybersecurity Act (Article 58),  and the Dutch Cybersecurity Regulation Implementation Act which implemented the Cybersecurity Act nationally. This entity is the national cybersecurity certification authority int he Netherlands.
	*'''Interest/value:''' as described on their [https://www.dutchncca.nl/about-the-ncca website], the NCAA has the following mandate:		*'''Interest/value:''' as described on their [https://www.dutchncca.nl/about-the-ncca website], the NCAA has the following mandate:

	**“Oversee the issuing of EU cybersecurity certificates at the CSA’s assurance level High;		**“Oversee the issuing of EU cybersecurity certificates at the CSA’s assurance level High;
	**Authorise Conformity Assessment Bodies (CABs) for the CSA certification schemes;		**Authorise Conformity Assessment Bodies (CABs) for the CSA certification schemes;
Line 17:		Line 13:
	**Market trust, consumer protection, and national security through verified cloud security standards”		**Market trust, consumer protection, and national security through verified cloud security standards”
	*'''Weakness:''' Heavily dependent on the EU-level EUCS framework, where if that scheme is weak or delayed, the NCCA's certification work lacks a solid foundation.		*'''Weakness:''' Heavily dependent on the EU-level EUCS framework, where if that scheme is weak or delayed, the NCCA's certification work lacks a solid foundation.
			'''3. European Data Protection Board (EDPB) (EU — public, supranational)'''
	#''' European Data Protection Board (EDPB) (EU — public, supranational)'''

	*'''Source of authority:''' GDPR (Regulation 2016/679)		*'''Source of authority:''' GDPR (Regulation 2016/679)
	*'''Governing instrument:''' GDPR; EDPB Guidelines (e.g. Guidelines 01/2020 on processing personal data in cloud services)		*'''Governing instrument:''' GDPR; EDPB Guidelines (e.g. Guidelines 01/2020 on processing personal data in cloud services)
	*'''Interest/value:''' Privacy and data protection; ensuring cloud providers processing EU personal data comply with fundamental rights obligations		*'''Interest/value:''' Privacy and data protection; ensuring cloud providers processing EU personal data comply with fundamental rights obligations
	*'''Weakness:''' Enforcement of the GDPR is left to national DPAs, which vary in resources and willingness to act (Ireland's DPA has been widely criticised for slow enforcement)		*'''Weakness:''' Enforcement of the GDPR is left to national DPAs, which vary in resources and willingness to act (Ireland's DPA has been widely criticised for slow enforcement)
			'''4. Gaia X '''(non-state, international)
	#''' Gaia X '''(non-state, international)

	*'''Source of authority:''' Voluntary membership organisation		*'''Source of authority:''' Voluntary membership organisation
	*'''Governing instrument:''' Gaia-X Trust Framework defines the minimum baseline to be part of the '''Gaia-X Ecosystem'''. This framework “provides a common governance and the basic level of interoperability across individual ecosystems”		*'''Governing instrument:''' Gaia-X Trust Framework defines the minimum baseline to be part of the '''Gaia-X Ecosystem'''. This framework “provides a common governance and the basic level of interoperability across individual ecosystems”
	*'''Interest/value:''' Gaia X [https://gaia-x.eu/about/ aims] to achieve digital sovereignty through innovation, and its [https://docs.gaia-x.eu/policy-rules-committee/compliance-document/3.1.0/Executive_Summary/ values] are “openness, transparency, data protection, security, and portability”		*'''Interest/value:''' Gaia X [https://gaia-x.eu/about/ aims] to achieve digital sovereignty through innovation, and its [https://docs.gaia-x.eu/policy-rules-committee/compliance-document/3.1.0/Executive_Summary/ values] are “openness, transparency, data protection, security, and portability”
	*'''Weakness:''' Gaia-X was trying to build sovereign infrastructure in the EU market where non-European hyperscalers (Microsoft, Google, Amazon) already dominate (Plixavra Vogiatzoglou and Joris van Hoboken, 'The EU's Digital Sovereignty and Quantum Technologies: To What End?')		*'''Weakness:''' Gaia-X was trying to build sovereign infrastructure in the EU market where non-European hyperscalers (Microsoft, Google, Amazon) already dominate (Plixavra Vogiatzoglou and Joris van Hoboken, 'The EU's Digital Sovereignty and Quantum Technologies: To What End?')