Data sovereignty as a mission imperative

Data drives decisions. Timely, accurate, and accessible data is essential for making the right calls and responding effectively. Now, with artificial intelligence at the forefront, increasing the velocity of information exponentially, the stakes are higher and maintaining sovereignty is harder than ever before. 

Data sovereignty is a mission imperative, not just a compliance checkbox or a cybersecurity buzzword. Whoever controls the data controls the decision. And whoever controls the decision controls the mission. 

If you are like most organization leaders, you probably assume that you own your data. Though, the question of data ownership is deceptively complex.

Who owns your data? Before answering, consider these six subsequent crucial questions: 

1. Who stores your data? 
2. Who administers the infrastructure? 
3. Who holds the encryption keys? 
4. Who maintains the software? 
5. What third parties have access to it, and under what conditions?
6. What is artificial intelligence learning from your data? 

I recently delivered a keynote address on this topic at the 16th Annual Peak Cyber Symposium in Colorado Springs. My hope is that attendees will leave with a deeper appreciation understanding of data sovereignty’s role in today’s environment. 

From cybersecurity to data sovereignty, and beyond

For decades, cybersecurity focused on protecting networks, endpoints, applications and identities. The arrival of cloud computing blurred traditional perimeters, and mobility accelerated this change. More recently, zero trust emerged as a new paradigm to guard against unauthorized access to networks and resources. 

Now, as AI becomes central to operations, the focus must shift again, from protecting infrastructure to maintaining persistent control of the data itself

There is distinction between data residency (Where is my data physically located?) and data sovereignty (Who ultimately controls it). Knowing the physical location isn’t enough to confer data sovereignty. Control depends on who administers the environment, owns the technology, holds encryption keys and governs access. 

Sovereignty must be viewed across multiple dimensions:

• Data sovereignty
• Operational sovereignty
• Technology sovereignty
• Jurisdictional sovereignty
• AI sovereignty

You can own the data and still lose control of the ecosystem surrounding it.

This is not, at its core, a cybersecurity issue. These are governance and mission questions.

Today, AI is changing the game all over again. Due to AI, the strategic value of data has increased dramatically, and AI adds even more layers to the question of ownership. When sensitive information is fed into AI systems, where does the data go? Who owns the AI model? Who controls the compute and resulting information? 

This is not, at its core, a cybersecurity issue. These are governance and mission questions. Maintaining AI sovereignty means maintaining control over the entire chain.

First steps to achieving sovereignty

Federal agencies seeking to gain and keep this comprehensive sovereignty need to start by gathering information. Consider these steps: 

• Integrate governance: Govern AI and data through the same framework to ensure decisions remain under mission owner control.
• Map critical data locations: Identify where your most important data resides, including backups, SaaS platforms, APIs, and AI systems.
• Audit the scope of access: Catalog every person, organization and system with authorized access to your data, including privileged administrators and third parties.
• Control protection mechanisms: Ensure you have visibility and authority over identity, encryption, keys and policy.
• Monitor AI consumption: Understand what AI systems are learning from your data, and track what happens to the data afterward.
• Plan for mission continuity: Assess whether you could maintain control of your data if normal infrastructure became unavailable or contested.
• Design for resilience: Build architecture that maintain control even when parts of the ecosystem fail or are compromised.

How we can help

Leveraging cloud, AI and commercial innovation without surrendering control of mission or data is the challenge of the moment for federal agencies. Ownership is control. Organizations must embrace innovation while ensuring technology remains under the control of those responsible for executing the mission.

To learn more about how our experts can help you achieve this result visit our website.