Assessment Platform
A structured framework for evaluating cloud and hybrid infrastructure against regional sovereignty requirements, compliance mandates, and vendor-independence controls — defended by an agentic AI security layer.
115
Questions
95 cloud + 20 on-prem
6
Pillars
Sovereignty domains
30
Frameworks
1,216 total controls
28
Regions
Global coverage
What is this platform?
The Sovereign Cloud Security Assessment Platform is a practitioner tool for cloud consultants, security architects, and compliance teams who need to evaluate whether a given cloud environment meets the sovereignty requirements of its target jurisdiction and regulatory framework.
Sovereignty in cloud computing extends beyond data residency. It includes control over encryption keys, administrative access, the ability to migrate infrastructure, exposure to foreign government access laws, and separation of identities from the secured platform.
This platform operationalises those concerns into a structured, scoreable model — producing per-pillar scores from 0–100, a list of failed controls with their effective penalty weights, and a prioritised remediation roadmap that consultants can present directly to clients.
For Hybrid Cloud environments, the platform extends coverage to on-premises and private cloud infrastructure — assessing physical access controls, patch cadence, hypervisor independence, colocation legal obligations, PAM coverage, and hardware supply chain integrity alongside the standard cloud controls.
In v3.0, the platform adds a full Agentic AI security layer — eight purpose-built agents running continuously to detect prompt injection, data leakage, session anomalies, supply chain risk, and compliance drift in real time.
The 6-Pillar Sovereignty Model
Data Sovereignty
Encryption key ownership, data residency enforcement, backup locality, cross-border transfer controls, and FIPS-validated cryptographic modules.
Operational Sovereignty
Administrator locality, CSP lockbox controls, support model localisation, immutable WORM audit logs, and sovereign SOC coverage.
Technological Sovereignty
Workload portability (containers vs proprietary PaaS), open-source tooling, cloud exit plan with tested RTO, and IaC vendor-neutrality.
Legal Sovereignty
CSP jurisdiction analysis, extraterritorial law exposure (CLOUD Act, FISA 702), DPA negotiation, subprocessor controls, and transparency reports.
Identity Sovereignty
Decoupled IdP architecture, JIT/PAM zero-standing-privilege, FIDO2 hardware MFA, secretless workload identities, and identity log residency.
Governance Sovereignty
Policy ownership and enforcement, risk management framework alignment, board-level accountability for cloud sovereignty, internal audit coverage, and third-party governance obligations.
AI Sovereignty
Training-data residency for AI/ML models, explainability and human oversight for regulated decisions, generative AI terms-of-service review, prompt data-loss prevention, and open-standard model portability.
Assessment Paths
Manual
115-question self-attested questionnaire across 6 sovereignty pillars. Cloud-only or full hybrid scope. Produces per-pillar scores, failed controls, and a prioritised remediation roadmap.
Launch assessment →
Automated
CSP API-driven audit of AWS, Azure, and GCP environments. Supports single-provider and multi-cloud (simultaneous scan with min-score merge). Runs in simulated mode when no credentials are provided.
Launch assessment →
Hybrid
40% questionnaire (self-attested) + 60% CSP live scan. Native Hybrid Cloud mode extends the questionnaire with 20 on-premises controls. On-prem sites are documented as structured audit scope records.
Launch assessment →
Agentic AI Security Layer
Eight purpose-built security agents protect the platform in real time — all running locally via Ollama with no external cloud dependency.
PromptGuard
Scans all assessment inputs for prompt injection, jailbreak attempts, and system-prompt hijacking before they reach the AI pipeline. Blocks and logs with MITRE technique mapping.
Evidence DLP
Inspects uploaded evidence files for secrets leakage — AWS keys, private keys, GitHub tokens, DB connection strings, and PII patterns. Rejects critical findings at upload time.
Session Risk
Scores every login against IP failure history, unusual access hours, new-IP detection, and multi-account targeting patterns. Elevates to audit trail for high/critical risk events.
API Anomaly
Analyses audit log events for brute-force patterns, credential stuffing sequences, cross-tenant probes, and bulk data scraping behaviours.
Compliance Monitor
Continuously verifies 10 platform-level controls against ISO 27001, EUCS, DORA, SOC 2, and OWASP API Top 10 — reporting pass/fail with control references.
Audit Intelligence
Generates activity summaries, policy violation alerts, and compliance drift insights from the rolling 7-day audit log window.
MITRE ATT&CK Mapper
Maps every detected threat type to MITRE ATT&CK v14 tactics and techniques — providing structured threat intelligence context for each security finding.
Supply Chain
Audits installed backend dependency versions against a minimum-version policy, flagging packages with known high-severity CVE exposure windows.
Supported Compliance Frameworks
See real-world use cases →30 frameworks across 8 jurisdictional groups — 1,216 controls total.
🇪🇺 European Union
EU Cybersecurity Act Article 54 — highest assurance tier for critical infrastructure and public bodies.
Network and Information Security Directive 2 — incident reporting, supply chain, and resilience obligations.
Data protection by design, DPA obligations, cross-border transfer safeguards (SCCs/BCRs).
Digital Operational Resilience Act — ICT risk management and third-party provider oversight for financial entities.
🏳️ EU Member States
France — highest-assurance sovereign cloud qualification for sensitive government workloads.
Germany — Cloud Computing Compliance Controls Catalogue, mandatory for federal agencies.
Germany — Criteria enabling Cloud Computing Autonomy; sovereignty criteria complementary to (and presupposing) BSI C5.
Spain — Esquema Nacional de Seguridad, high-impact cloud controls for public administration.
Netherlands — Baseline Information Security Government, Dutch public sector cloud baseline.
🇬🇧 United Kingdom
NCSC Cloud Security Principles — Assured / Basic / Partial tiers for UK public sector cloud procurement.
🇺🇸 United States
Federal cloud security standard for high-impact systems. Enforces FIPS 140-2, US-person access, and continental data residency.
Cybersecurity Maturity Model Certification — DoD supply chain, CUI handling, and 110 NIST SP 800-171 practices.
Identify · Protect · Detect · Respond · Recover framework with new Govern function.
🇮🇳 India
Digital Personal Data Protection Act 2023 — consent management, data fiduciary obligations, and cross-border transfer restrictions.
Reserve Bank of India cloud outsourcing guidelines — data localisation, audit rights, and exit management.
🌏 Asia-Pacific
Australia — Information Security Registered Assessors Program, PROTECTED classification cloud controls.
Australia — Eight mitigation strategies prioritised by the Australian Signals Directorate.
Australia — Prudential Standard for information security in financial institutions.
New Zealand Information Security Manual — government cloud security baseline.
Singapore — Monetary Authority Technology Risk Management guidelines for financial institutions.
Japan — Centre for Financial Industry Information Systems security standards.
South Korea — Information Security Management System & Privacy combined certification.
🌍 Middle East & Africa
Saudi Arabia — National Cybersecurity Authority Cloud Cybersecurity Controls.
Saudi Arabia — Saudi Arabian Monetary Authority Cyber Security Framework for financial sector.
🌐 Global / Cross-jurisdictional
Information security management system standard — 93 controls across 4 themes.
Privacy information management system extension to ISO 27001.
Business continuity management — RTO/RPO, BIA, and crisis response obligations.
Payment Card Industry Data Security Standard — 12 requirements for cardholder data environments.
Cloud Security Alliance Cloud Controls Matrix — 197 controls across 17 domains.
Release History
Full version changelog — v1.0.0 through v3.1.0
Disclaimer
Assessment results produced by this platform represent a structured self-attested evaluation based on the answers provided by the consultant and simulated CSP findings. They do not constitute a formal audit opinion, legal advice, or regulatory certification. Organisations seeking EUCS accreditation, FedRAMP authorisation, or equivalent formal assurance should engage a qualified, accredited third-party assessor. Mandatory gate control configurations and penalty weights should be reviewed against current regulatory guidance before use in formal compliance submissions.
Sovereign Cloud Security Assessment Platform
Version 3.1.0 · Built August 2026 · Python 3.11 · Next.js 14