Single cloud providers have their limits. A multi-cloud strategy overcomes them: Azure, Google Cloud, the Deutsche Verwaltungscloud and sovereign platforms complement each other, and the result is maximum flexibility with full compliance. This article builds on our Cloud Migration Roadmap for the Public Sector.
Multi-Cloud is the Future of Public Sector IT
The public sector benefits particularly: specialised workloads find their optimal platform, and digital sovereignty is maintained by placing each workload where its protection needs are met — not where the first contract happened to be signed.
What Multi-Cloud Really Means
Multi-cloud is more than just using two providers. It is a strategy, an architecture, and an operating model. The Cloud Adoption Framework for Azure provides the methodology; a GCP Landing Zone provides the structure; a sovereign landing zone covers the workloads that must stay under EU control.
Each workload is analysed. Where does it run best? Azure? GCP? A sovereign cloud in Germany? The answer is often: it depends — on data classification, required services, cost and exit strategy.
The Building Blocks of a Multi-Cloud Architecture
Governance Layer — Centralised control is essential. Azure and GCP landing zones follow common principles: uniform policies as code, consistent monitoring, and end-to-end security.
Connectivity Layer — Azure ExpressRoute connects data centres; Google Cloud Interconnect complements it. Hybrid scenarios become possible and datacenter migration proceeds without interruption — see Multi-Cloud Connectivity.
Security Layer — BSI C5 applies across the board. One BSI-compliant cloud security concept covers all platforms; IT-Grundschutz in the cloud and ISO 27001 remain the standard.
Application Layer — This is where multi-cloud shows its strength. Kubernetes runs on AKS, GKE and sovereign platforms alike. Containers are portable. Vendor lock-in is avoided.
Quick Checklist: Multi-Cloud Readiness
| Area | Checkpoint | Status |
|---|---|---|
| Governance | Central Policy Engine Defined | ☐ |
| Network | Connectivity Concept Created | ☐ |
| Security | BSI C5 Mapping for All Clouds | ☐ |
| Identity | Centralised IAM Planned | ☐ |
| Costs | FinOps Process Established | ☐ |
| Operations | Multi-Cloud Monitoring Active | ☐ |
| Exit | Portability and exit plan tested per workload | ☐ |
To-Do List for Multi-Cloud Success
- Immediately: Conduct a cloud strategy workshop.
- Week 1: Start workload classification.
- Week 2: Create a compliance matrix.
- Month 1: Build landing zones in parallel.
- Month 2: Migrate pilot workloads.
- Month 3: Establish governance processes.
Structuring Tenders and Procurement Correctly
A cloud migration tender requires expertise. The procurement of cloud service providers follows public procurement law (VgV, EVB-IT); a cloud framework agreement accelerates procurement. Consulting should begin before the tender so that requirements — C5 Type 2 attestation, DVC conformity, EU operator control, exit clauses — are written into the specification and offers become comparable.
Migration costs vary widely. A fixed-price migration creates certainty, provided the assessment phase has produced a reliable inventory.
Compliance as an Enabler
Being BSI C5 compliant is not an obstacle; it is a mark of quality. KRITIS cloud security becomes the standard and NIS2 integrates European requirements. A Data Protection Impact Assessment for the cloud is mandatory — it protects citizens and the authority alike.
The Insight42 Approach
We understand multi-cloud, public authorities and procurement. From strategy to operations we deliver landing zones, migration and managed services across Azure, GCP and sovereign platforms from a single source.
Start now. See Souveräne Cloud Beratung (German) or contact us.