Fundaments' sovereign Cloud

Fundaments achieved the VMware Sovereign Cloud status in 2022. With this status, we demonstrate the fact that Fundaments takes Cloud sovereignty to the next level. This means that we are committed to ensuring data protection and compliance while taking national laws and regulations into account, as well as protecting all data in the Cloud from the increasing digital threats. We do this by continuously striving to improve on controlling where data lands.

We help our partners in their journey towards the most optimal data continuity and security. We accomplish this through a Sovereign Cloud Framework. In this article you can read what exactly Fundaments' Sovereign Cloud means and how we are implementing the framework together with our partners.

‍

What is Fundaments' sovereign Cloud?

With our sovereign Fundaments Cloud, we offer our partners the most secure and reliable Cloud foundation. Looking at the Fundaments Cloud, we can operate it independently and have everything from A to Z in control: from people to process as well as technology. This starts with how we set up a data center, all the way to how we ensure the continuity of organizations with the choices for hardware, software and the setup thereof. We also ensure that we take day-to-day management to the highest level with our knowledgeable colleagues. How the Cloud is consumed must therefore be clear throughout the chain and we are extremely critical of this. In this, continuity is the key word: business-critical applications must always be able to keep running, without interruption. For example, our data centers are geographically separated and we only use Dutch data centers. In addition, we as an organization and our data centers meet the appropriate certifications regarding information security and continuity.

‍

‍

Sovereign Cloud Framework

We bring our partners the most optimal data continuity and security through the use of the Sovereign Cloud Framework. This framework, as shown below, includes a number of steps we deploy to land data in the best place, in the right Cloud and with the right measures to ensure availability and continuity.

Stap 1:In this first step, we examine whether we understand our client and place the focus on the specialty required. Do we have the expertise for it? Many organizations are in a certain market segment. For Fundaments, the organization we help has wishes and requirements that we can fulfill with our solutions. For example, hosting issues for application developers and management issues on applications that require a local data center are our specialty.

Stap 2: Next, we have a conversation with the Data Officer, Security Officer and CISO. Which policies are followed and which parties are involved in application management? By mapping out the total governance on the customer side, Fundaments with its own management organization can fully guarantee the processing of data that lands on a platform. Should this be partly impossible, clarifying the demarcation on responsibilities and risks is also part of this step.

Stap 3: In this third step, it is important to look at all the data and how it is classified. Think of classifications such as 'public', 'internal', 'confidential' or 'secret'. But besides that, classification can also be done on the impact on business processes: when data is not available, what is the impact for an organization? Equally, what does it mean if data gets into the wrong hands? All these properties are identified in this step.

Stap 4: Based on the data classification in the previous step and especially on the policies on data management, in this fourth step an analysis is done on where data may be stored and processed.

Stap 5: Besides storing and knowing the value of data in terms of classification, it is important to know who processes the data and how. Who is the exact management organization that protects the data and ensures its availability? Which individuals work with the data and what processes ensure proper processing? Identifying the management organization and also determining the jurisdiction within which the organization operates will help establish a risk profile.

Step 6: this step examines how to ensure continuous compliance. Protecting and keeping data available is a continuous process that should always receive attention in a deming cycle . In many certifications this is guaranteed. For Fundaments, this means that from our ISAE3402 type I and II certifications, among others, this is made transparent in a report on our process improvements. But also policy on innovation, research on product security and improving knowledge by training employees are part of this framework.

Step 7: from all the previous steps, it is clear which Cloud can be chosen. For public data, a hyperscaler can be a solution, but for government applications, the entire chain must make clear where the data is hosted and who processes it. Technical requirements can also play a role in this; think of the physical distance between user and processing of the user's data. Fundaments also looks at the portability of data between Clouds, especially when an exit-strategy is explicitly desired, the migration to and from a Cloud is looked at extensively.

Step 8: In the growth and dependence on data, keeping it protected and available is a requirement, but also the set of applications and the underlying platform are constantly changing. Keeping up with developments is an important part, especially since very often security methods also become more diverse and stronger within this development. In addition, the chosen Cloud platform must be able to facilitate this.


"Nowadays, making data available online and protecting it is the central issue, Cloud is a means and no longer the end in this."
Larik-Jan Verschuren - CTO bij Fundaments.


Going through the framework maps out all the relevant issues for your data. With Fundaments' sovereign Cloud platform, you can find all the elements to make the right choices. In addition, Fundaments' Cloud Experts provide a solid, well-argued strategy for your business-critical data.

‍

‍