This morning (7 October 2026), SAFARI was presented to an audience of 325 auditors from the Dutch Tax and Customs Administration. SAFARI is an open methodology that helps organisations assess and substantiate their digital sovereignty systematically.
Digital sovereignty concerns the control an organisation actually has over its digital services, data and suppliers. Can it make its own choices? Can it continue operating if a supplier, technology or part of the supply chain becomes unavailable? And can it demonstrate which laws govern its data and systems?
Without a consistent measurement method, answers soon remain general or depend on supplier statements. SAFARI shows where an organisation stands, what evidence supports that position and where further work is needed.
From ambition to demonstrable results
SAFARI stands for Sovereignty Assurance Framework for Autonomy, Resilience & Independence. It connects the eight objectives of the European Commission’s European Cloud Sovereignty Framework with the controls in ISO 27001:2022.
SAFARI takes the customer’s perspective. Supplier promises matter, but the decisive question is how much control the organisation has in practice.
The assessment covers strategic control, law and jurisdiction, data and AI, operational continuity, the supply chain, technology, security and compliance, and sustainability.
For each subject, SAFARI determines a maturity level from 0 to 4. The available evidence receives a separate level. A supplier statement is not equivalent to a contractual commitment, technical evidence or independent verification.
Fixed questions, explicit scoring rules and evidence requirements make results traceable and repeatable. An organisation can therefore measure both its current position and progress over time.
What does an auditor gain?
SAFARI gives auditors a structured framework for a subject that crosses several disciplines. It supports consistent assessments and links findings to concrete sources.
The methodology separates maturity from the strength of evidence. Far-reaching measures without sufficient evidence do not automatically produce a strong conclusion. Conversely, SAFARI shows when measures have been demonstrably embedded.
For assurance engagements, SAFARI follows the structure of ISAE 3000. Depending on the evidence, the outcome may be no conclusion, limited assurance or reasonable assurance.
What does an organisation gain?
SAFARI makes digital sovereignty manageable. For each subject, the assessment shows the target level, the demonstrably achieved level, dependencies and risks, missing evidence and priority improvements.
The overall level is not an average. The lowest-scoring core objective determines it. A high result in one area therefore cannot conceal a material weakness elsewhere.
The outcome can support decision-making, risk management, supplier discussions and the monitoring of improvements.
What does a procurement professional gain?
SAFARI translates digital sovereignty into concrete, verifiable questions. Labels such as “European cloud”, “data in Europe” or “sovereign solution” do not by themselves establish who is actually in control.
SAFARI helps examine who ultimately controls a supplier, which legal systems apply, where data and metadata are processed, which subcontractors and technical dependencies exist, how exit is arranged and what evidence supports the supplier’s answers.
This is useful when preparing a tender, evaluating bids and managing existing contracts. Each organisation selects the level it needs based on its risks and responsibilities.
Open and reusable
SAFARI is open source under the Creative Commons Attribution-ShareAlike 4.0 licence. It may be used, shared and adapted, including commercially, subject to attribution and share-alike conditions.
The current release is version 0.9, a draft open to review, corrections and improvements.
The complete methodology is available in the public SAFARI repository.
SAFARI was made possible by De Winter Information Solutions and Vigilis Consultancy.