Data Center Programmer Using Digital Laptop Computer, Maintenance IT Specialist. Cloud Computing Server Farm System Administrator Working on Cyber Security for Iaas, saas, paas. Closeup Focus on Hands
Multi-Cloud Uncategorized

The Data Guardian’s Guide to Selecting a Sovereign Cloud: Part 1

The Family Holiday – Selecting the Right Hotel.

Alex Tanner, Senior Staff Cloud Solutions Architect, VMware Partner Connect Cloud Provider partners, UK&I

Sovereign Cloud and the sovereignty of data more broadly are filling column inches in the media currently. The usual suspects in any discussion around cloud, the U.S. hyper scale public clouds, and their aligned in-country partners, are moving rapidly to dominate this debate with their views on what constitutes a sovereign cloud and in debuting their respective sovereign cloud offerings into the European market.

With all the various perspectives on sovereign cloud and the sovereignty of data – and its relevance to cloud consumers – being aired publicly across the continent, it is becoming difficult to understand what it all means. This is especially true for those responsible for corporate or public data, when there would appear to be very little in common between the many competing definitions of sovereignty as it pertains to data and how best to address the concerns raised by the likes of GDPR, the US Cloud Act and Schrems II

Our guide to selecting a sovereign cloud is not aligned to a technology stack or a solution offering but is more about proposing a framework of assessment that people responsible for safeguarding corporate or public data, (data guardians), can use to evaluate whether a specific sovereign cloud offering is right for them.

As we enter the holiday season, and to avoid this being a dull technical discourse, we have decided to use the analogy of planning a family holiday.  This helps highlight how we formulated this framework for selecting a sovereign cloud and the various criteria one should consider when choosing the right home for different data types and classifications. This will be where the focus of the first blog will be.

We will then in part 2 go through each layer in line in the graphic below as if you were planning a family holiday to highlight why we have chosen these elements and how they map to assessing an organization’s sovereign cloud needs.

Framework Criteria

Let Us Set the Scene for the Family Holiday.

Family holidays are a time for adults to entertain their children while also finding time for themselves. So, a well planned and executed family holiday can make amazing memories, whereas a badly planned holiday can leave permanent scars. In this respect it is not unlike the decision as to where to host one’s valuable corporate or public data.

In our scenario, the family of four, two adults and two children, is looking for a local holiday in an area steeped with history but also known for offering great sporting facilities and many other leisure and educational opportunities.

The two adults map to the Chief Architect role (Adult A) and the CIO / CTO role (Adult C). The children in this family correspond to the applications and data under the care and management of Adult A and Adult C for the purposes of explanation. This may seem a little contrived, but a good CIO/CTO and Chief Architect should be equally concerned about the integrity of the data their business runs on as they might be about the happiness of their progeny on vacation.

One of the children, Child NS (Non-Sensitive) is a gregarious, sporty, and easy going individual interested in a range of activities and not requiring much parental oversight or other special requirements. The second child, Child S (Sensitive), has more specialist needs and typically requires more ongoing, trained hands-on management and care to be content. Child S is also subject to certain specific regulatory oversight that mandates how their care, education, and wellbeing should be organized. In the technology arena these children reflect data classifications where the first, Child NS, is non-sensitive data and is eligible under law and in practical terms to be placed in a range of environments. The second child, Child S, maps to sensitive data and needs careful management, accountability, and hosting according to a much stricter set of regulatory and jurisdictional guidelines.

The International Hotel

✅ Broad scope of Leisure activities, ✅ Basic room, ✅ Chargeable Extras, ✅ Low base cost

Adult A is looking at a range of options by way of holiday accommodation and has broadly three choices. The first choice is accommodation run by a well-known international hotel brand that has a leisure center attached to the hotel and offers a broad range of sport and leisure activities. Guests consume the basic package of the room but then all other facilities and activities are chargeable individually including paying for people resources, such as sports coaches and kindergarten staff, to look after their children. The staff are trained to an international standard, come from all over the globe and are practiced in their respective areas of sport, leisure, or hotel management. Adult C is enamoured of this option given the range of activities on offer and the modern nature of the hotel and its facilities. The hotel company does a particularly excellent job of marketing their approach as the best way to conduct a fun and inclusive family holiday and is very popular globally with families.

The International Franchise Hotel

✅ Localized services, ✅ Localized knowledge, ✅ Broad scope of Leisure activities, ✅ Basic room, ✅ Chargeable Extras, ✅ Medium base cost

The second choice is like the first but more localised. In this case the accommodation on offer is more of a franchise operation where many of the services, activities, and facilities of the international hotel brand are available at this franchise hotel, but where a local partner company owns the operation and does the overall management of the hotel and its facilities. This has some appeal as the services are more localised as are the staff who have received additional training that is more locally relevant in line with regulations and jurisdictions. However, as this is a smaller operation some of the activities and facilities offered by the international hotel brand are not available and other aspects such as loyalty rewards are not redeemable with this franchise operation. Like the international hotel brand, guests consume the basic package of the room and then all other facilities and activities are chargeable. Adult A likes this option better as they feel that both Child S and Child NS could be better catered for at this hotel and that any adjudication and redress for any issues that might arise would happen locally. The local pedigree of the partner company also appeals in terms of ensuring Child S has access to local knowledge and relevant activities in line with their interests beyond the more generic sport and leisure activities favoured by Child NS.

The Boutique Hotel

✅ Tailored services, ✅ Localized knowledge, ✅ Small scope of on-premise Leisure activities, ✅ External Leisure facility support, ✅ Basic room, ✅ Chargeable Extras,

✅ Expensive

The final choice is a local boutique hotel owned and operated as a family business that has been in the area for many years and which specialises in family holidays and providing a very tailored experience. The owner’s two adult children are highly trained and experienced in managing a range of different children’s needs from sports through to educational and other leisure activities as well as knowing the area very well resulting in bespoke guided tours and access to sites of historic interest not normally known to the more mainstream hotel operators.

This accommodation varies from the first two options in that it works with the guests to create specific packages of activities and services and on balance is more expensive and labour intensive as the hotel makes a real effort to understand their guests and consequently tailor a very relevant package of activities and services.

Initially dismissed by both Adult C, for not offering the broad scope of activities, facilities, or perks that they were looking for, and by Adult A for lacking the training and skills needed to support the children, subsequent correspondence with the boutique hotel revealed a hugely different picture. Not only did the boutique hotel have the deep local knowledge to enable the whole family to maximise their enjoyment of the local area and pursue their respective interests in terms of history and education, but through agreements with the international hotel brand, staff at the boutique hotel could leverage all the facilities and activities located at the international brand hotel while providing tailored guidance and hands on support for their guests in all environments. The boutique hotel’s team also had impressive levels of local training and a short accountability chain. Any issues with any aspect of the boutique hotel’s staff, processes or facilities could be immediately addressed by the single manger and owner of the hotel, whereas similar challenges in either of the other two accommodation choices risked being routed offshore into shared systems where recourse and outcomes were far less clear due to adjudication potentially occurring outside of the local market.

Please look out for my second blog which provides the assessment criteria, which hotel wins and your role as the data guardian in selecting a sovereign cloud.

In the meantime, to learn more about the VMware approach to sovereign clouds please contact us here and working with our Partners to have your own sovereign cloud assessment please reach out here.