SAFARI

SAFARI stands for Sovereignty Assurance Framework for Autonomy, Resilience & Independence. It is an open methodology for assessing the digital sovereignty of cloud services from the customer’s perspective: what control does an organisation actually have, and what evidence supports it?

Support for procurement

SAFARI helps make digital-sovereignty requirements concrete before a tender or contract negotiation. The organisation chooses the required minimum level for each subject. Fixed questions, evidence requirements and scoring rules make offers easier to compare and reveal missing information, agreements or technical safeguards at an early stage.

The highest level is not always necessary. An organisation selects the desired level based on the service’s use, data and risks. SAFARI provides recommended minimum levels as a starting point; an organisation may deviate from them if it records its reasons.

Assurance with an appropriate degree of confidence

SAFARI assesses two matters separately:

• the achieved sovereignty level from 0 to 4;
• the quality of the evidence, also from 0 to 4.

Both the desired minimum level and the intended degree of confidence are recorded in advance. The conclusion then shows whether that minimum has been reached and whether the evidence is strong enough for no conclusion, limited assurance or reasonable assurance. This aligns the degree of confidence with what the organisation actually needs to demonstrate.

Frameworks used

The European Cloud Sovereignty Framework (ECSF) is the starting point. SAFARI uses the ECSF’s eight sovereignty objectives and levels, but takes the customer’s perspective and treats the weakest link as decisive for the overall level.

SAFARI also links the assessment to:

• ISO 27001:2022 for relevant controls;
• ISAE 3000 for the structure of the assurance conclusion;
• current legislation and regulations, including the GDPR, Data Act, NIS2, DORA and Cyber Resilience Act;
• the proposed Cloud and AI Development Act (CADA), solely as an indicative assessment while the proposal is not applicable law.

The complete methodology, questionnaires and scoring rules are publicly available in the SAFARI repository.

SAFARI was made possible by De Winter Information Solutions and Vigilis Consultancy.