In the first part of our blog series, we showed that digital sovereignty is not a political vision but a business fundamental. Yet sovereignty starts with the foundation. Data centers, cloud and IT infrastructure determine whether control is truly real. Three questions get to the heart of it: Where is the data physically located? Who operates the systems? And under which jurisdiction does this happen? Anyone who cannot answer these questions is building their digitalization on foreign ground.

For a long time, digital sovereignty was a term reserved for strategy papers and empty rhetoric. That has changed. Geopolitical tensions, new regulations, and growing dependence on a handful of providers have turned a political buzzword into a tangible business issue. Anyone making decisions today about the cloud, data, IT architecture, or IT security is also making decisions about control, freedom of action, and future viability. It’s high time to turn this topic on its head: What does digital sovereignty really mean – and what does it mean specifically for your company?

In many companies, the summer months are considered a quiet period. Employees are on vacation, key contacts are hard to reach and temporary arrangements replace standard procedures. Cybercriminals know exactly that – and exploit it deliberately. Firewalls, Zero Trust, endpoint security – none of that helps much if a single employee clicks on a phishing email. People are the most effective target. They can’t be patched. And they’re particularly vulnerable in the summer.