PwC Germany has launched the Sovereignty Maturity Index. This provides organizations with a single score to determine how sovereign they are. All dependencies, from infrastructure to software, expertise, and data, are mapped out. According to PwC, open source plays a central role in reducing those dependencies, although that is a more nuanced story than a single score can capture.
In the IT industry, we often speak of digital sovereignty using context-sensitive definitions. PwC Germany hopes to bring more consistency to discussions on this topic, and on sovereignty in a broader sense within organizations. The new assessment is intended for businesses and public organizations and targets IT leaders, procurement professionals, architects, and management.
At the same time, the call for a measurable form of sovereignty has been frequently heard and regularly criticized. After all, what constitutes a degree of sovereignty? Should it depend on the sector, the type of software, or how easy it is to switch away from a product? If we’re talking about just one specific area, such as cloud usage, the conclusion, based on any definition, is that the majority of European organizations fall short. After all, AWS, Microsoft Azure, and Google Cloud together control about 70 percent of the European cloud market. European providers, meanwhile, remain stuck at around 15 percent.
Score from 0 to 4
PwC evaluates four dimensions for the index. For infrastructure, the analysis focuses on data centers, the cloud, networks, and the ability to switch providers (also known as “stickiness”). For software, PwC examines vendor lock-in; for data, it looks at storage location, access, and portability. For expertise, or “know-how,” the focus is on whether an organization can understand and further develop its own systems. Each dimension is assigned a score from 0 (“dependent”) to 4 (the coveted “strategically sovereign”). Governance, contracts, and service providers are also assessed. Clients receive critical findings, a target vision, and a roadmap with priorities. The process takes six to twelve weeks to produce a score.
PwC cites geopolitical tensions, complex licensing models, and regulations such as NIS2, DORA, and the EU Data Act as the impetus for the new index. Although we don’t have access to the data, it could be argued that the hyperscalers and other tech companies, through their product announcements, are demonstrating that market research points to a growing importance of sovereignty.
Open source as a lever
According to PwC, open source is a key prerequisite for sovereignty because it prevents vendor lock-in and builds internal expertise. It remains a somewhat debatable concept, however, since maintainers may well be based outside Europe, and for lesser-known projects, there isn’t necessarily a replacement available from within the continent. In any case, Brussels is also committed to open source and aims to reduce its dependence on cloud and AI services by using that software and its own data centers.
“Digital sovereignty begins with transparency regarding dependencies. Not all of them pose a risk,” says Marcel Scholze, Director of Open Source, Digital Sovereignty, and IT Sourcing at PwC Germany. According to him, it is a multidimensional process, not a goal you reach and then check off the list.
Read also: The unexpected consequences of digital sovereignty