Meta Description: Sovereign Cloud Germany: What does digital sovereignty mean for public authorities? Data residency, key management, and BSI C5 compliance.
What Does Digital Sovereignty Mean?
Digital sovereignty is the ability to control one’s own IT infrastructure and data with self-determination. For the public sector, this is not a luxury but a necessity. It is about controlling citizen data, independence from individual providers, and compliance with German and European legal norms (GDPR, Schrems II).
A sovereign cloud in Germany provides the technical and organizational framework to ensure this control. It combines the innovative power of global hyperscalers (like Azure and GCP) with the strict requirements of German and European law.
The Three Pillars of Digital Sovereignty
1. Data Residency
What it is: The guarantee that data and metadata are stored and processed exclusively within a defined geographical area (e.g., Germany).
Why it matters: Prevents access by foreign authorities based on laws like the US CLOUD Act. Ensures compliance with GDPR.
Implementation: Use of cloud regions in Germany (e.g., Frankfurt, Berlin). Contractual assurances from the provider.
2. Control & Transparency
What it is: The ability to seamlessly control and log access to data and systems, including access by the cloud provider itself.
Why it matters: Creates trust. Enables proof of compliance (BSI C5, GDPR).
Implementation: Strict access controls (Zero Trust, MFA), comprehensive logging, use of external control bodies (e.g., data trustees).
3. Key Management
What it is: Control over the cryptographic keys used to encrypt data. Whoever holds the key, controls the data.
Why it matters: It is the ultimate lever for data sovereignty. Even if a provider could access the encrypted data, they cannot read it without the key.
Implementation: Bring Your Own Key (BYOK) or Hold Your Own Key (HYOK), where the keys remain within your own infrastructure.
Quick Checklist: Digital Sovereignty
Pillar
Key Question
Implemented?
Data Residency
Is all data guaranteed to be in Germany/EU?
☐
Control
Do we have full control over all access?
☐
Transparency
Is all access logged completely?
☐
Key Management
Do we control the cryptographic keys?
☐
Compliance
Are the requirements of GDPR, BSI C5, etc., met?
☐
To-Do List for a Sovereign Cloud Strategy
Immediately: Classify the protection needs of the data.
Week 1: Define the requirements for digital sovereignty.
Week 2: Evaluate the market for sovereign cloud offerings (e.g., Azure, GCP, T-Systems Sovereign Cloud).
Month 1: Establish a strategy for data residency and key management.
Month 2: Adapt the BSI-compliant cloud security concept accordingly.
Month 3: Start a pilot project in a sovereign cloud environment.
Sovereign Offerings from Hyperscalers
The major providers have recognized the need and offer special solutions:
Microsoft Cloud for Sovereignty: Offers data residency, enhanced controls, and transparency. Partners like T-Systems provide additional data trustee models.
Google Cloud Sovereign Solutions: Provides similar guarantees for data location and control, often in partnership with local providers.
These offerings are an important step but require careful examination. Cloud consulting for public authorities helps to validate the providers’ promises and find the right solution for your needs.
The Role of BSI C5 and IT Baseline Protection
Digital sovereignty and compliance go hand in hand. Being BSI C5 compliant is a basic requirement for a sovereign cloud. The controls in the C5 catalog cover many aspects of sovereignty, especially in the areas of transparency and operational security.
IT Baseline Protection consulting helps to integrate the BSI’s requirements into the cloud architecture. An ISO 27001 certification based on IT Baseline Protection demonstrates the effectiveness of the implemented measures.
Insight42: Your Guide to Digital Sovereignty
The path to a sovereign cloud is complex. We navigate you safely through the technological, legal, and organizational challenges. We know the offerings, the pitfalls, and the success factors.
We help you develop a strategy tailored to your specific protection needs—from data residency to external key management. Secure, BSI C5 compliant, and future-proof.
Take control. Contact us.
Figure: The Three Pillars of Digital Sovereignty in the Cloud
Blog Post 2: Cloud Key Management – BYOK vs. HYOK in Azure and GCP
Meta Description: Cloud Key Management: The ultimate lever for data sovereignty. A comparison of BYOK (Bring Your Own Key) and HYOK (Hold Your Own Key) in Azure and GCP.
Whoever Holds the Key, Holds the Power
Encryption is the foundation of cloud security. But who controls the keys? By default, the cloud provider does. This is convenient, but often not sufficient for sensitive government data. Because whoever controls the key can decrypt the data. This includes the provider itself and potentially foreign authorities.
The solution: Take control of your keys yourself. The two most important models for this are Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK).
Bring Your Own Key (BYOK)
The Principle: You create your keys in your own environment (e.g., with an on-premises Hardware Security Module – HSM) and securely import them into the cloud provider’s key management system (e.g., Azure Key Vault, GCP Cloud KMS).
Advantages:
Full control over the creation and lifecycle of the key.
The key can be revoked (deleted) at any time, rendering the data unusable.
Relatively simple integration with most cloud services.
Disadvantages:
The key is physically located in the provider’s cloud. Access by the provider, though unlikely, is not 100% technically impossible.
Hold Your Own Key (HYOK) / External Key Management
The Principle: The key never leaves your own controlled environment. The cloud services send the data to be encrypted or decrypted to your external key manager. The key itself is never transferred.
Advantages:
Maximum control and sovereignty. The key is physically and logically separate from the cloud.
Access by the cloud provider or third parties is technically impossible.
Disadvantages:
Higher complexity and potentially higher latency.
Requires a highly available own key management infrastructure.
External key management is not an isolated topic. It must be integrated into the overall BSI-compliant cloud security concept. It is a central measure for meeting the requirements of BSI C5, IT Baseline Protection, and GDPR.
The processes surrounding key management must be clearly defined and documented. Who can create keys? Who approves their use? What happens in an emergency? IT Baseline Protection consulting helps to design these processes robustly.
Insight42: Experts in Cloud Key Management
We help you regain control over your keys and thus your data. We analyze your needs, compare the solutions, and implement the model that is right for you.
Whether it’s BYOK with Azure Key Vault or HYOK with external HSMs – we have the expertise to technically implement your sovereign cloud strategy. Secure, compliant, and manageable.
Lock your data securely. Talk to us.
Figure: Comparison of Key Management Models BYOK and HYOK
Data Protection Impact Assessment (DPIA) for the Cloud
Resilience, SECURITY 23rd Feb 2026Sutirtha
A Guide for Public Authorities
Meta Description: A guide to Data Protection Impact Assessments (DPIAs) for cloud projects in the public sector. GDPR-compliant, secure, and practical.
Why a DPIA is Mandatory for Cloud Projects
The cloud offers enormous opportunities, but it also poses risks to data protection. The General Data Protection Regulation (GDPR) therefore requires a Data Protection Impact Assessment (DPIA) when there is a high risk to the rights and freedoms of natural persons. For the public sector, which works with sensitive citizen data, this is almost always the case for cloud projects.
A DPIA is not an obstacle; it is a tool for risk minimization. It forces a systematic engagement with data protection and creates legal certainty for your cloud project. A missing DPIA can lead to significant fines and the halting of the project.
When Exactly is a DPIA Required?
Article 35 of the GDPR is clear. A DPIA is required, in particular, for:
Large-scale processing of special categories of data (e.g., health data).
Systematic and extensive evaluation of personal aspects (profiling).
Large-scale monitoring of publicly accessible areas.
The German Data Protection Conference (DSK) has published a positive list of processing activities for which a DPIA is generally required. The use of cloud services for specialized procedures with large amounts of data often falls into this category.
The 4 Steps of a Data Protection Impact Assessment
A DPIA follows a structured process. It is not a one-time document but a living process.
Step 1: Systematic Description
What? What data is being processed?
Why? What is the purpose of the processing?
Who? Who are the parties involved (controller, processor)?
How? What technologies and processes are being used?
Step 2: Assessment of Necessity and Proportionality
Is the processing truly necessary for the purpose? Are there milder, more data-minimizing alternatives? The legal basis must be clear.
Step 3: Risk Assessment
What are the risks to the data subjects (citizens)? (e.g., unauthorized access, data loss, discrimination). The likelihood of occurrence and the severity of the potential harm are assessed.
Step 4: Remedial Measures
What technical and organizational measures (TOMs) will be taken to minimize the risks? This includes encryption, access controls, and contractual arrangements with the cloud provider.
Quick Checklist: DPIA for the Cloud
Step
Key Question
Done?
1. Description
Is the processing completely described?
☐
2. Necessity
Is the legal basis clear and the processing proportionate?
☐
3. Risk Assessment
Are the risks to data subjects identified and assessed?
☐
4. Measures
Are effective remedial measures defined?
☐
5. Documentation
Is the entire DPIA comprehensibly documented?
☐
6. Consultation
Must the Data Protection Officer or the supervisory authority be consulted?
☐
To-Do List for the DPIA
Immediately: Clarify whether a DPIA is mandatory for the cloud project.
Week 1: Appoint a responsible team for the DPIA.
Week 2: Involve the Data Protection Officer at an early stage.
Month 1: Begin the systematic description of the processing.
Month 2: Conduct the risk assessment.
Month 3: Define remedial measures with the cloud service provider and the IT security team.
Ongoing: Update the DPIA whenever the system changes.
The Challenge: Third-Country Transfers
Since the Schrems II ruling, data transfers to the US and other third countries have become complex. Cloud providers like Microsoft (Azure) and Google (GCP) are US companies. A DPIA must explicitly assess this risk.
Remedial measures for this include:
Standard Contractual Clauses (SCCs): The standard mechanism, but often not sufficient on its own.
Additional TOMs: Strong encryption (ideally with your own keys – BYOK/HYOK), pseudonymization, anonymization.
Sovereign Cloud Options: Use of data centers in Germany/EU and contractual assurances (e.g., sovereign cloud Germany).
Insight42: Your Partner for the Cloud DPIA
A DPIA for cloud services requires legal, technical, and procedural knowledge. We connect these worlds. Our Data Protection Impact Assessment consulting is practice-oriented and tailored to the public sector.
We help you identify risks, define effective measures, and design your cloud projects to be legally compliant, in line with BSI C5 and IT Baseline Protection.
Make your data protection future-proof. Contact us.
Figure: The 4-Step Process of a Data Protection Impact Assessment for the Cloud
Blog Post 2: GDPR-Compliant Cloud Usage – TOMs in Azure and GCP
Meta Description: Implementation of Technical and Organizational Measures (TOMs) according to GDPR in Azure and GCP. Practical examples for public authorities.
From Requirement to Technology
Article 32 of the GDPR calls for “appropriate technical and organizational measures” (TOMs) to ensure a level of security appropriate to the risk. But what does this mean in practice in the cloud? How do you translate legal requirements into technical configurations in Azure or GCP?
This article shows how to practically implement the abstract requirements of the GDPR using the native tools of the major cloud platforms. The cloud provider only supplies the tools; the authority, as the controller, is responsible for their correct use.
Mapping GDPR Requirements to Cloud Services
1. Pseudonymization and Encryption (Art. 32(1)(a))
Goal: Make data unreadable to unauthorized persons.
Azure:
Encryption at Rest: Transparent Data Encryption (TDE) for databases, Storage Service Encryption for storage accounts.
Encryption in Transit: Enforce TLS 1.2+ for all connections.
Key Management: Azure Key Vault for secure storage and management of keys (Bring Your Own Key – BYOK possible).
GCP:
Encryption at Rest: Enabled by default for all services.
Encryption in Transit: Default for all connections.
Key Management: Cloud Key Management Service (Cloud KMS), also with a BYOK option.
2. Confidentiality and Integrity (Art. 32(1)(b))
Goal: Ensure that only authorized persons can access data and that it cannot be altered unnoticed.
Azure:
Access Control: Entra ID with Conditional Access and MFA, Privileged Identity Management (PIM) for admin rights.
Network Security: Network Security Groups (NSGs) and Azure Firewall for segmentation.
GCP:
Access Control: Cloud IAM with Conditions, Identity-Aware Proxy (IAP) for Zero Trust access.
Network Security: VPC Firewall Rules and Cloud Armor.
3. Availability and Resilience (Art. 32(1)(b))
Goal: Ensure that systems function even in the event of disruptions or attacks.
Azure:
High Availability: Use of Availability Zones and Availability Sets.
Scalability: Virtual Machine Scale Sets, App Service Plans.
GCP:
High Availability: Distribution of instances across multiple zones.
Scalability: Managed Instance Groups (MIGs).
4. Recoverability (Art. 32(1)(c))
Goal: Be able to quickly restore data and systems after an incident.
Azure: Azure Backup for backing up VMs, databases, and file shares. Azure Site Recovery for disaster recovery.
GCP: Backup and DR Service, Snapshots for Persistent Disks.
5. Regular Testing and Evaluation (Art. 32(1)(d))
Goal: Continuously verify the effectiveness of the TOMs.
Azure: Microsoft Defender for Cloud for monitoring security configuration and detecting threats. Azure Policy for enforcing compliance rules.
GCP: Security Command Center for centralized vulnerability and compliance management.
Quick Checklist: Important TOMs in the Cloud
TOM Category
Measure
Implemented?
Encryption
Data-at-Rest & Data-in-Transit fully active
☐
Access
MFA for all administrative and privileged accounts
☐
Network
Strict segmentation and firewall rules
☐
Backup
Regular, tested backups of all critical systems
☐
Monitoring
Continuous monitoring of security configuration
☐
Patching
Timely application of security updates
☐
TOMs as Part of the Security Concept
The defined TOMs are a central component of the security concept according to BSI C5 or IT Baseline Protection. They demonstrate how information security objectives are technically implemented. Good documentation of the TOMs is therefore essential not only for GDPR but also for audits according to BSI C5 or ISO 27001.
Cloud consulting for public authorities helps to select and implement the right TOMs for your specific requirements. It is not about doing everything that is technically possible, but what is appropriate for the risk.
Insight42: We Make Your Cloud GDPR-Compliant
We translate the GDPR into the language of the cloud. We configure Azure and GCP to meet the requirements for technical and organizational measures—securely, documented, and auditable.
Our Managed Cloud Operations include the continuous monitoring and optimization of your TOMs. This ensures that your data protection level remains high even as threats and technologies change.
Implement data protection technically. Talk to us.
Figure: Technical and Organizational Measures (TOMs) according to GDPR in the Cloud
data protection impact assessment cloud, gdpr cloud, technical and organisational measures, toms gdpr, public sector cloud migration, bsi c5 compliant, it baseline protection consulting, sovereign cloud germany, azure data protection, gcp data protection, schrems ii, third country transfer, cloud consulting for authorities, bsi cloud security concept, data security, data protection compliant, data processing agreement, dpa cloud
“))oxiaomi.file(action = “write”, brief = “Translate the seventh blog post file into English”, path = “/home/ubuntu/insight42_blogs/final_docs/en/07_gdpr_dsfa_dpia.md”, text = “# Topic 7: GDPR + DPIA for cloud workloads
Blog Post 1: Data Protection Impact Assessment (DPIA) for the Cloud – A Guide for Public Authorities
Meta Description: A guide to Data Protection Impact Assessments (DPIAs) for cloud projects in the public sector. GDPR-compliant, secure, and practical.
Why a DPIA is Mandatory for Cloud Projects
The cloud offers enormous opportunities, but it also poses risks to data protection. The General Data Protection Regulation (GDPR) therefore requires a Data Protection Impact Assessment (DPIA) when there is a high risk to the rights and freedoms of natural persons. For the public sector, which works with sensitive citizen data, this is almost always the case for cloud projects.
A DPIA is not an obstacle; it is a tool for risk minimization. It forces a systematic engagement with data protection and creates legal certainty for your cloud project. A missing DPIA can lead to significant fines and the halting of the project.
When Exactly is a DPIA Required?
Article 35 of the GDPR is clear. A DPIA is required, in particular, for:
Large-scale processing of special categories of data (e.g., health data).
Systematic and extensive evaluation of personal aspects (profiling).
Large-scale monitoring of publicly accessible areas.
The German Data Protection Conference (DSK) has published a positive list of processing activities for which a DPIA is generally required. The use of cloud services for specialized procedures with large amounts of data often falls into this category.
The 4 Steps of a Data Protection Impact Assessment
A DPIA follows a structured process. It is not a one-time document but a living process.
Step 1: Systematic Description
What? What data is being processed?
Why? What is the purpose of the processing?
Who? Who are the parties involved (controller, processor)?
How? What technologies and processes are being used?
Step 2: Assessment of Necessity and Proportionality
Is the processing truly necessary for the purpose? Are there milder, more data-minimizing alternatives? The legal basis must be clear.
Step 3: Risk Assessment
What are the risks to the data subjects (citizens)? (e.g., unauthorized access, data loss, discrimination). The likelihood of occurrence and the severity of the potential harm are assessed.
Step 4: Remedial Measures
What technical and organizational measures (TOMs) will be taken to minimize the risks? This includes encryption, access controls, and contractual arrangements with the cloud provider.
Quick Checklist: DPIA for the Cloud
Step
Key Question
Done?
1. Description
Is the processing completely described?
☐
2. Necessity
Is the legal basis clear and the processing proportionate?
☐
3. Risk Assessment
Are the risks to data subjects identified and assessed?
☐
4. Measures
Are effective remedial measures defined?
☐
5. Documentation
Is the entire DPIA comprehensibly documented?
☐
6. Consultation
Must the Data Protection Officer or the supervisory authority be consulted?
☐
To-Do List for the DPIA
Immediately: Clarify whether a DPIA is mandatory for the cloud project.
Week 1: Appoint a responsible team for the DPIA.
Week 2: Involve the Data Protection Officer at an early stage.
Month 1: Begin the systematic description of the processing.
Month 2: Conduct the risk assessment.
Month 3: Define remedial measures with the cloud service provider and the IT security team.
Ongoing: Update the DPIA whenever the system changes.
The Challenge: Third-Country Transfers
Since the Schrems II ruling, data transfers to the US and other third countries have become complex. Cloud providers like Microsoft (Azure) and Google (GCP) are US companies. A DPIA must explicitly assess this risk.
Remedial measures for this include:
Standard Contractual Clauses (SCCs): The standard mechanism, but often not sufficient on its own.
Additional TOMs: Strong encryption (ideally with your own keys – BYOK/HYOK), pseudonymization, anonymization.
Sovereign Cloud Options: Use of data centers in Germany/EU and contractual assurances (e.g., sovereign cloud Germany).
Insight42: Your Partner for the Cloud DPIA
A DPIA for cloud services requires legal, technical, and procedural knowledge. We connect these worlds. Our Data Protection Impact Assessment consulting is practice-oriented and tailored to the public sector.
We help you identify risks, define effective measures, and design your cloud projects to be legally compliant, in line with BSI C5 and IT Baseline Protection.
Make your data protection future-proof. Contact us.
Figure: The 4-Step Process of a Data Protection Impact Assessment for the Cloud
Blog Post 2: GDPR-Compliant Cloud Usage – TOMs in Azure and GCP
Meta Description: Implementation of Technical and Organizational Measures (TOMs) according to GDPR in Azure and GCP. Practical examples for public authorities.
From Requirement to Technology
Article 32 of the GDPR calls for “appropriate technical and organizational measures” (TOMs) to ensure a level of security appropriate to the risk. But what does this mean in practice in the cloud? How do you translate legal requirements into technical configurations in Azure or GCP?
This article shows how to practically implement the abstract requirements of the GDPR using the native tools of the major cloud platforms. The cloud provider only supplies the tools; the authority, as the controller, is responsible for their correct use.
Mapping GDPR Requirements to Cloud Services
1. Pseudonymization and Encryption (Art. 32(1)(a))
Goal: Make data unreadable to unauthorized persons.
Azure:
Encryption at Rest: Transparent Data Encryption (TDE) for databases, Storage Service Encryption for storage accounts.
Encryption in Transit: Enforce TLS 1.2+ for all connections.
Key Management: Azure Key Vault for secure storage and management of keys (Bring Your Own Key – BYOK possible).
GCP:
Encryption at Rest: Enabled by default for all services.
Encryption in Transit: Default for all connections.
Key Management: Cloud Key Management Service (Cloud KMS), also with a BYOK option.
2. Confidentiality and Integrity (Art. 32(1)(b))
Goal: Ensure that only authorized persons can access data and that it cannot be altered unnoticed.
Azure:
Access Control: Entra ID with Conditional Access and MFA, Privileged Identity Management (PIM) for admin rights.
Network Security: Network Security Groups (NSGs) and Azure Firewall for segmentation.
GCP:
Access Control: Cloud IAM with Conditions, Identity-Aware Proxy (IAP) for Zero Trust access.
Network Security: VPC Firewall Rules and Cloud Armor.
3. Availability and Resilience (Art. 32(1)(b))
Goal: Ensure that systems function even in the event of disruptions or attacks.
Azure:
High Availability: Use of Availability Zones and Availability Sets.
Scalability: Virtual Machine Scale Sets, App Service Plans.
GCP:
High Availability: Distribution of instances across multiple zones.
Scalability: Managed Instance Groups (MIGs).
4. Recoverability (Art. 32(1)(c))
Goal: Be able to quickly restore data and systems after an incident.
Azure: Azure Backup for backing up VMs, databases, and file shares. Azure Site Recovery for disaster recovery.
GCP: Backup and DR Service, Snapshots for Persistent Disks.
5. Regular Testing and Evaluation (Art. 32(1)(d))
Goal: Continuously verify the effectiveness of the TOMs.
Azure: Microsoft Defender for Cloud for monitoring security configuration and detecting threats. Azure Policy for enforcing compliance rules.
GCP: Security Command Center for centralized vulnerability and compliance management.
Quick Checklist: Important TOMs in the Cloud
TOM Category
Measure
Implemented?
Encryption
Data-at-Rest & Data-in-Transit fully active
☐
Access
MFA for all administrative and privileged accounts
☐
Network
Strict segmentation and firewall rules
☐
Backup
Regular, tested backups of all critical systems
☐
Monitoring
Continuous monitoring of security configuration
☐
Patching
Timely application of security updates
☐
TOMs as Part of the Security Concept
The defined TOMs are a central component of the security concept according to BSI C5 or IT Baseline Protection. They demonstrate how information security objectives are technically implemented. Good documentation of the TOMs is therefore essential not only for GDPR but also for audits according to BSI C5 or ISO 27001.
Cloud consulting for public authorities helps to select and implement the right TOMs for your specific requirements. It is not about doing everything that is technically possible, but what is appropriate for the risk.
Insight42: We Make Your Cloud GDPR-Compliant
We translate the GDPR into the language of the cloud. We configure Azure and GCP to meet the requirements for technical and organizational measures—securely, documented, and auditable.
Our Managed Cloud Operations include the continuous monitoring and optimization of your TOMs. This ensures that your data protection level remains high even as threats and technologies change.
Implement data protection technically. Talk to us.
Figure: Technical and Organizational Measures (TOMs) according to GDPR in the Cloud
Resilience, SECURITY, Sovereignty Series 20th Feb 2026Martin-Peter Lambert
A Guide for Public Authorities
Meta Description: BSI C5 Cloud certification for the public sector. Audit readiness, compliance requirements, and the BSI-compliant cloud security concept.
What is BSI C5?
BSI C5 is the German standard for cloud security, developed by the Federal Office for Information Security (BSI). It defines minimum requirements for cloud services and is often mandatory for the public sector.
Is cloud migration for the public sector possible without BSI C5? It’s risky. Tenders for cloud migration usually demand it, and the procurement process for cloud service providers verifies the certification.
The Structure of BSI C5
BSI C5 comprises 17 requirement domains, from organization to incident management. Each domain contains specific controls that must be demonstrated.
The 17 Domains at a Glance:
Information Security Organization, Security Policies, Human Resources, Asset Management, Physical Security, Operations Security, Identity and Access Management, Cryptography, Communication Security, Portability and Interoperability, Procurement and Development, Supplier Relationships, Security Incident Management, Compliance, Data Protection, Product Security, Interoperability.
Type 1 vs. Type 2 Attestation
BSI C5 has two attestation types, and the difference is important.
Type 1 Attestation
This assesses the appropriateness of the controls at a specific point in time. – Are the controls designed? – Are they implemented?
Type 2 Attestation
This assesses the effectiveness of the controls over a period of at least six months. – Do the controls work? – Are they being followed?
For public authorities, a Type 2 attestation is usually required. It offers more security and demonstrates continuous compliance.
Quick Checklist: BSI C5 Readiness
Domain
Checkpoint
Status
Organization
ISMS Established
☐
Policies
Security Policies Documented
☐
Personnel
Awareness Training Conducted
☐
Assets
Inventory Complete
☐
Access
IAM Implemented
☐
Cryptography
Encryption Active
☐
Logging
Logging Enabled
☐
Incident
Process Defined
☐
To-Do List for BSI C5 Certification
Month 1: Conduct a gap analysis.
Month 2: Create an action plan.
Months 3-6: Implement controls.
Month 7: Perform an internal audit.
Month 8: Conduct an external pre-audit.
Months 9-10: Undergo the Type 1 audit.
Months 11-16: Operational phase.
Month 17: Undergo the Type 2 audit.
The Path to Attestation
Becoming BSI C5 compliant is a project. It requires planning, resources, and expertise.
Step 1: Gap Analysis
Where do you stand today? Which controls are missing? IT baseline protection consulting helps with the assessment. The gap analysis shows the way forward.
Step 2: Action Planning
What measures are necessary?
In what order? With what budget?
The action plan is created and when is it due?
Step 3: Implementation
Controls are introduced
Processes are established
Documentation is created
The BSI-compliant cloud security concept is developed
Step 4: Audit
An auditor conducts the review. The controls are tested. Evidence is collected. The attestation is issued.
Cloud Providers and BSI C5
Major cloud providers like Azure, GCP, and AWS have BSI C5 attestations. But that’s not enough to claim that using them makes you compliant—quite the opposite. Because of the shared responsibility model, you still need to implement the right controls and operate them correctly. Only then can you be C5-compliant.
Azure migration and GCP migration must consider BSI C5. An Azure Landing Zone and a GCP Landing Zone should incorporate BSI C5 controls. The Cloud Adoption Framework for Azure helps with this.
Insight42 BSI C5 Services
We guide public authorities to BSI C5 compliance, from gap analysis to the audit. By provide the BSI-compliant cloud security concept from a single source and the implementation of those, we make your life easy, compliant and reliable.
Our cloud consulting services for authorities with a BSI C5 focus and cloud managed services for continuous compliance are delivered on Critical (KRITIS) level and have been withstanding audits and security challenges.
Become BSI C5 compliant. Contact us.
Figure: The Path to BSI C5 Certification
Blog Post 2: Preparing for a BSI C5 Audit – Practical Tips for the Public Sector
Meta Description: BSI C5 audit preparation for public authorities. Practical tips, documentation, and evidence collection. Create a BSI-compliant cloud security concept.
The Audit is Approaching
You have decided on BSI C5. Implementation is underway. Now comes the audit. How do you prepare? What can you expect?
BSI C5 audits are thorough. Auditors want to see evidence, not just documents, but also established practices. This article prepares you.
Documentation is Everything
No attestation without documentation. Auditors can only audit what is documented. Every control needs evidence. Every process needs a description.
What must be documented: Security policies and their approval, process descriptions with responsibilities, configuration standards and their implementation, employee training records, and logs as proof.
The Most Common Audit Findings
Preparation also means avoiding mistakes. These findings are common:
Incomplete Documentation
Controls exist but are not documented, or the documentation is outdated. Solution: Keep documentation current by automising it via IT, BI & AI. We do that all the time, ensuring reality and documentation are always in sync.
Missing Evidence
Processes are followed but not logged. Solution: Enable logging and recording.
Inconsistent Implementation
Policies exist but are not followed. Solution: Conduct regular internal audits.
Unclear Responsibilities
No one feels responsible. Solution: Create a RACI matrix.
Quick Checklist: Audit Preparation
Document
Content
Current?
ISMS Manual
Overall Security Overview
☐
Security Policies
All Policies
☐
Risk Analysis
Current Assessment
☐
Asset Register
Complete Inventory
☐
Access Matrix
Permissions Documented
☐
Incident Log
Incidents Logged
☐
Training Records
All Employees
☐
Audit Trail
Changes Traceable
☐
To-Do List for Audit Readiness
8 weeks prior: Fully review documentation.
6 weeks prior: Conduct an internal pre-audit.
4 weeks prior: Remediate findings.
2 weeks prior: Compile evidence.
1 week prior: Brief interview partners.
Audit Day: Stay calm, cooperate.
After Audit: Remediate findings promptly.
The BSI-Compliant Cloud Security Concept
The security concept is the centerpiece. It comprehensively describes your cloud security. Auditors will read it carefully.
Contents of the Security Concept:
Scope and demarcation of cloud use, risk analysis and assessment, technical and organizational measures, responsibilities and processes, and emergency and business continuity management.
IT baseline protection consulting helps with its creation. ISO 27001 based on IT-Grundschutz provides the structure. The result: an audit-proof document.
Mastering Interviews
Auditors conduct interviews. They want to understand how controls are put into practice. Preparation is of the utmost importance!
Continuous Compliance
BSI C5 is not a one-time project; it is a continuous process. After the audit is before the audit.
Cloud managed services for authorities help with this through continuous monitoring, regular reviews, and automated compliance checks.
Azure managed services and GCP operations provide support with dashboards showing compliance status and alerts for deviations.
Insight42 Audit Support
We guide you through the audit: preparation, execution, and follow-up, with experienced consultants by your side.
We create the BSI-compliant cloud security concept together. IT baseline protection consulting is our core business. BSI C5 compliance is our goal.
AI In The Public Sector, Azure CAF & Cloud Migration, Growth, Resilience, Sovereignty Series 18th Feb 2026Martin-Peter Lambert
The Path to Zero Trust
Meta Description: Entra ID Migration for Public Authorities is essential for organisations in the public sector seeking to implement SSO, MFA, and Zero Trust. BSI C5 compliant and IT-Grundschutz ready.
Identity is the New Perimeter
Firewalls alone are no longer enough. Employees work from anywhere. Cloud services are distributed. Identity has become the central security anchor. Zero Trust is the answer.
This is particularly relevant for the public sector. Sensitive data must be protected. An Entra ID migration creates the foundation. BSI C5 Cloud requirements are met.
What Zero Trust Means
Zero Trust is a security model: never trust, always verify. Every access attempt is checked. Every identity is validated.
It sounds strict, and it is. But it works. Attacks are made more difficult. Lateral movement is prevented. The BSI-compliant cloud security concept recommends this approach.
The Pillars of Zero Trust
Verify Identity
Who is accessing the resource? Is the person who they claim to be? Multi-Factor Authentication is mandatory. Passwords alone are not enough.
Validate Device
From which device is the access coming? Is it managed? Is it compliant? Conditional Access checks these factors.
Minimize Access
The principle of least privilege applies. Only necessary rights, only for the necessary time. Just-in-Time access becomes the standard.
Monitor Activities
Every access is logged. Anomalies are detected. Automated responses are triggered.
Quick Checklist: Zero Trust Implementation
Component
Action
Priority
MFA
Enable for all users
Critical
SSO
Set up Single Sign-On
High
Conditional Access
Create baseline policies
High
PIM
Implement Privileged Identity Management
High
Device Compliance
Define device policies
Medium
App Protection
Configure application protection
Medium
Monitoring
Monitor sign-in logs
Medium
To-Do List for Entra ID Migration
Immediately: Enable MFA for administrators.
Week 1: Take inventory of identities.
Week 2: Define the SSO strategy.
Week 3: Plan Conditional Access policies.
Month 1: Migrate a pilot group.
Month 2: Roll out to all users.
Month 3: Implement PIM.
SSO Simplifies and Secures
Single Sign-On is not a luxury; it is a security feature. Fewer passwords mean less risk. Users use strong passwords because they only need one.
Entra ID enables SSO for thousands of applications, both in the cloud and on-premises. SAML, OAuth, and OpenID Connect are all supported.
SSO is essential for public sector cloud migration. Azure migration and GCP migration benefit. Users work seamlessly while security is maintained.
Implementing MFA Correctly
Multi-Factor Authentication is mandatory. BSI C5 compliance without MFA? Impossible. IT baseline protection consulting requires it, as does NIS2 compliance consulting.
But MFA must be user-friendly. Authenticator apps are standard. Biometrics where possible. Hardware tokens for high security.
Conditional Access makes MFA intelligent. Not for every login, only when there is a risk. Unknown device? MFA. Unusual location? MFA.
Protecting Privileged Identities
Administrators are prime targets. Their accounts have extensive rights. Privileged Identity Management (PIM) protects them.
The principle is Just-in-Time access. Rights are activated only when needed, for a limited time, and with approval.
The BSI-compliant cloud security concept demands these controls. KRITIS cloud security requires them. Insight42 implements them.
Insight42 Identity Services
We are experts in Entra ID migration. Zero Trust is our standard. BSI C5 compliance is our promise.
From strategy to operation, we offer cloud managed services for identity for public authorities, including Azure managed services.
Secure your identities. Contact us.
[Image: Zero Trust Architecture]
Figure: Zero Trust Identity Architecture for Public Authorities
Blog Post 2: Conditional Access and MFA – Intelligent Access Control for Public Administration
Meta Description: Conditional Access and MFA for public authorities. Intelligent, BSI C5 compliant, and IT-Grundschutz-based access control. Secure and user-friendly.
Rethinking Access Control
Old models are obsolete. Once authenticated, always trusted? Dangerous. Conditional Access changes the game. Every access is evaluated. Context is key.
This is revolutionary for the public sector. Security becomes dynamic. User-friendliness is maintained. A cloud-first administration becomes secure.
What Conditional Access Does
Conditional Access is a policy framework that evaluates access in real-time. Who? From where? With what device? To what? These questions are answered.
Based on the answers, decisions are made: allow access, block access, require MFA, or restrict the session.
Understanding the Signals
User and Group
Who is accessing? Administrators have different rules than standard users. Externals different from internals.
Location
Where is the access coming from? Known networks are more trustworthy. Unknown countries are blocked.
Device
Is the device managed? Is it compliant? Unknown devices require additional verification.
Application
Which app is being accessed? Sensitive applications need stronger protection.
Risk
Entra ID automatically assesses risk. Unusual behavior is detected. Compromised accounts are locked.
Quick Checklist: Conditional Access Policies
Policy
Goal
Action
MFA for Admins
Protect privileged accounts
Enforce MFA
Blocked Countries
Stop attacks from high-risk regions
Block access
Compliant Devices
Allow only secure devices
Require compliance
Block Legacy Auth
Prevent insecure protocols
Block
Session Timeout
Reduce risk during inactivity
Limit session
App Protection
Protect sensitive apps
Require MFA + Compliance
To-Do List for Conditional Access
Day 1: Activate report-only mode.
Week 1: Define baseline policies.
Week 2: Enforce MFA for all admins.
Week 3: Block legacy authentication.
Month 1: Introduce device compliance.
Month 2: Implement location-based policies.
Month 3: Implement risk-based policies.
Comparing MFA Methods
Not all MFA methods are equal. Some are more secure, others more user-friendly. The right choice depends on the context.
Microsoft Authenticator
Push notifications are simple. Number matching increases security. Passwordless login is possible.
FIDO2 Security Keys
Hardware-based and phishing-resistant. Ideal for high-security environments. Slightly higher cost.
SMS and Phone
Easy to implement, but less secure. Recommended only as a fallback.
Windows Hello
On-device biometrics. Very user-friendly. Requires compatible hardware.
Meeting Compliance Requirements
BSI C5 Cloud demands strong authentication. Conditional Access delivers it. IT baseline protection consulting confirms compliance.
ISO 27001 based on IT-Grundschutz requires access control. Conditional Access documents every access. Audits are passed.
NIS2 compliance consulting recommends Zero Trust. Conditional Access is a core component. It supports the Data Protection Impact Assessment for the cloud.
Integration with Other Services
Conditional Access does not stand alone. It integrates with Microsoft Defender, uses Intune for device compliance, and connects to SIEM for monitoring.
Public sector cloud migration benefits from this integration. The Azure Landing Zone includes Conditional Access. Azure managed services monitor the policies.
Insight42 Conditional Access Services
We design Conditional Access strategies tailored for public authorities. BSI C5 compliant and user-friendly.
From analysis to implementation, we provide cloud consulting for authorities with a focus on identity and cloud managed services for operations.
Control access intelligently. Talk to us.
www.insight42.de
Azure ExpressRoute for Public Authorities –
AI In The Public Sector, Resilience, Sovereignty Series 16th Feb 2026Martin-Peter Lambert
A Secure Connection to the Cloud
Meta Description: Azure ExpressRoute setup for the public sector. Secure connectivity, BSI C5 compliant, and datacenter migration to Azure with a dedicated line.
Why ExpressRoute is Essential for Public Authorities
The public internet is not an option. Sensitive government data requires dedicated connections. An Azure ExpressRoute setup provides this security through private lines, guaranteed bandwidth, and low latency.
Cloud migration for the public sector demands reliable connectivity. A datacenter migration to Azure only works with a stable connection. ExpressRoute delivers both: security and performance.
What Azure ExpressRoute Offers
ExpressRoute is a private connection that completely bypasses the internet. Data flows over dedicated lines, with carrier partners providing the infrastructure.
For the public sector, this means BSI C5 cloud requirements are met. The BSI-compliant cloud security concept can point to secure connectivity, strengthening KRITIS cloud security.
Understanding the Architecture
ExpressRoute Circuit
The circuit is the physical connection linking your data center to Microsoft. Various bandwidths are available, from 50 Mbps to 100 Gbps.
Peering Types
Private Peering connects to Azure VNets, while Microsoft Peering reaches Microsoft 365. Both can be used in parallel.
Redundancy
High availability requires redundancy. Two circuits at different locations ensure automatic failover in case of an outage, meeting government SLAs.
Quick Checklist: ExpressRoute Setup
Step
Task
Responsible
1
Determine Bandwidth Needs
IT Department
2
Select Carrier Partner
Procurement
3
Order Circuit
Carrier
4
Configure Azure
Cloud Team
5
Set Up Routing
Network Team
6
Implement Redundancy
Cloud Team
7
Activate Monitoring
Operations
To-Do List for Secure Connectivity
Today: Analyze current bandwidth usage.
This Week: Research carrier options.
This Month: Create the ExpressRoute design.
Quarter 1: Commission the circuit.
Quarter 2: Start migration over ExpressRoute.
Mastering Hybrid Scenarios
Not everything moves to the cloud at once. Hybrid architectures are a reality. ExpressRoute connects both worlds, allowing on-premises and Azure to work together.
A VMware to Azure migration particularly benefits, as large data volumes are transferred quickly. Replication runs in the background, and the cutover occurs without significant downtime.
Security at All Levels
ExpressRoute is secure by design, but additional measures are possible, such as encryption over the line and IPsec tunnels for extra protection.
IT baseline protection consulting recommends defense in depth. Multiple security layers, with ExpressRoute being one, are complemented by firewalls and segmentation.
Costs and Procurement
Azure ExpressRoute has two cost components: Microsoft charges for the circuit, and the carrier charges for the line. Both must be budgeted.
A cloud framework agreement can simplify procurement. A cloud migration tender should include connectivity. Cloud migration costs become transparent.
Insight42 Connectivity Services
We plan and implement ExpressRoute, from needs analysis to operation. Azure migration consulting includes connectivity.
Azure managed services monitor the connection with proactive monitoring and rapid response to issues, ensuring SLA-compliant operation.
Connect securely. Contact us.
Azure ExpressRoute Architecture
Figure: Azure ExpressRoute Architecture for Public Authorities
Blog Post 2: Multi-Cloud Connectivity – Combining ExpressRoute and Cloud Interconnect
Meta Description: Multi-cloud connectivity with Azure ExpressRoute and Google Cloud Interconnect. Secure connections for the federal multi-cloud strategy.
Multi-Cloud Needs Multi-Connectivity
The federal multi-cloud strategy is a reality. Azure and GCP are used in parallel. But how do you connect them securely? The answer: dedicated lines to both clouds.
Azure ExpressRoute for Microsoft and Google Cloud Interconnect for GCP. Both operate on similar principles and offer enterprise-grade security.
Understanding Google Cloud Interconnect
Cloud Interconnect is Google’s equivalent of ExpressRoute. Dedicated Interconnect provides physical connections, while Partner Interconnect uses carrier infrastructure.
Interconnect is crucial for GCP migration. Large data volumes must be transferred. GKE migration benefits from low latency. Google Cloud migration partners recommend dedicated connections.
The Architecture for Multi-Cloud
Central Network Hub
A hub connects everything: on-premises, Azure, and GCP. Routing is centrally controlled, and security is uniformly enforced.
ExpressRoute to the Azure Hub
Private Peering connects to Azure VNets. A hub-and-spoke topology distributes traffic. The Azure Landing Zone is the destination.
Interconnect to the GCP Hub
Use either Dedicated or Partner Interconnect. A Shared VPC receives the traffic. The GCP Landing Zone takes over.
Inter-Cloud Connection
Azure and GCP can also be connected directly through partner solutions or the central hub.
Quick Checklist: Multi-Cloud Connectivity
Cloud
Connection Type
Bandwidth
Redundancy
Azure
ExpressRoute
As needed
Dual Circuit
GCP
Dedicated Interconnect
As needed
Dual Attachment
Inter-Cloud
Partner/Hub
As needed
Active-Active
To-Do List for a Multi-Cloud Network
Week 1: Conduct a traffic analysis.
Week 2: Create a connectivity design.
Week 3: Prepare the carrier tender.
Month 1: Order ExpressRoute.
Month 2: Order Interconnect.
Month 3: Optimize routing.
Month 4: Establish monitoring.
VPN as a Backup and Entry Point
Not every authority needs dedicated lines immediately. VPN is a valid entry point. A Site-to-Site VPN connects securely at a lower cost.
Azure VPN Gateway and Cloud VPN from GCP both support IPsec and offer high availability. They are often sufficient for smaller workloads.
The transition to ExpressRoute or Interconnect can happen later when bandwidth or latency become critical. Cloud migration consulting helps with the decision.
Connectivity Compliance
Being BSI C5 compliant also means secure connections. The BSI-compliant cloud security concept must address connectivity. Encryption is mandatory, even on dedicated lines.
A Data Protection Impact Assessment (DPIA) for the cloud considers data flows. Where does data flow? Via which paths? These questions must be answered.
Optimizing Costs
Multi-cloud connectivity is not cheap, but it is necessary. FinOps approaches help with optimization. Traffic routing is analyzed, and costs are allocated.
A fixed-price for cloud migration can include connectivity. A cloud migration offer should be transparent. IT service providers for the public sector know the requirements.
Insight42 Multi-Cloud Network Services
We design multi-cloud networks, providing ExpressRoute and Interconnect from a single source for secure, performant, and cost-effective solutions.
Cloud managed services for authorities monitor the connections with proactive monitoring and rapid troubleshooting, guaranteed by SLAs.
Connect your clouds. Talk to us.
Figure: Multi-Cloud Connectivity with ExpressRoute and Interconnect
IT Baseline Protection – ISO 27001 (Based on IT Baseline Protection)
Resilience, SECURITY 15th Feb 2026Martin-Peter Lambert
ISO 27001 Based on IT Baseline Protection – The Royal Road for Public Authorities
Meta Description: ISO 27001 certification based on IT Baseline Protection (IT-Grundschutz). The proven path for the public sector. BSI-compliant, secure, and efficient.
Why IT Baseline Protection is the Standard for Public Authorities
The BSI’s IT Baseline Protection is more than a recommendation; it is the de facto standard for information security in German public administration. It offers concrete measures, field-tested building blocks, and a clear methodology, which makes it incredibly valuable.
An ISO 27001 certification is internationally recognized and demonstrates a functioning Information Security Management System (ISMS). Combining these two worlds is ideal: the specific guidelines of IT Baseline Protection fulfill the abstract requirements of ISO 27001.
The Synergy of IT Baseline Protection and ISO 27001
ISO 27001 requires an ISMS but does not specify how to implement it. IT Baseline Protection provides exactly that: a detailed guide. Those who implement IT Baseline Protection have already done most of the work for an ISO 27001 certification.
The advantages of this combination:
Concrete and Field-Tested: IT Baseline Protection offers ready-made building blocks.
BSI-Recognized: The methodology is well-established within the German public sector.
Efficient: It avoids duplication of effort.
Internationally Recognized: The ISO 27001 certification builds trust.
The Path to Certification
Step 1: Structural Analysis
Which information, processes, and IT systems need protection? The structural analysis defines the scope of the ISMS.
Step 2: Protection Needs Assessment
How critical is the data? Normal, high, or very high? The protection needs assessment evaluates the requirements for confidentiality, integrity, and availability.
Step 3: Modeling According to IT Baseline Protection
The identified systems are mapped to the building blocks of the IT-Grundschutz Compendium. The result is a list of relevant requirements.
Step 4: Basic Security Check
This is a gap analysis. Which requirements are already implemented? Where are the gaps? The basic security check identifies the need for action.
Step 5: Implementation and Audit
The gaps are closed. The ISMS is put into practice. An external auditor verifies conformity and issues the ISO 27001 certificate.
Quick Checklist: ISO 27001 Based on IT Baseline Protection
Phase
Task
Status
1. Preparation
Define Scope
☐
2. Analysis
Conduct Structural Analysis
☐
3. Assessment
Determine Protection Needs
☐
4. Modeling
Map IT Baseline Protection Building Blocks
☐
5. Gap Analysis
Perform Basic Security Check
☐
6. Implementation
Execute Action Plan
☐
7. Audit
Certification Audit
☐
To-Do List for Project Managers
Immediately: Secure management commitment.
Week 1: Appoint an ISMS team.
Week 2: Commission IT Baseline Protection consulting.
Month 1: Start the structural analysis.
Month 2: Complete the protection needs assessment.
Quarter 2: Conduct the basic security check.
Quarters 3-4: Implement measures.
Next Year: Plan the certification audit.
IT Baseline Protection in the Cloud
The principles of IT Baseline Protection also apply in the cloud, but the implementation differs. Responsibility is shared. Cloud providers (Azure, GCP) deliver a secure foundation, while the authority is responsible for secure configuration and use (Shared Responsibility Model).
An ISO 27001 certification based on IT Baseline Protection for cloud workloads is possible. It requires a clear understanding of responsibilities. BSI C5 Cloud requirements are also integrated here. The BSI-compliant cloud security concept documents the implementation.
Insight42: Your Partner for IT Baseline Protection
We are experts in ISO 27001 based on IT Baseline Protection. We understand the requirements of the public sector. Our IT Baseline Protection consulting is field-tested and efficient.
We guide you from the initial analysis to successful certification and beyond, with managed services for continuous security and compliance.
Start on the secure path. Contact us.
Figure: The Synergy of IT Baseline Protection and ISO 27001
Blog Post 2: IT Baseline Protection in the Cloud – Practical Implementation in Azure and GCP
Meta Description: Practically implement IT Baseline Protection in the cloud. ISO 27001 based on IT-Grundschutz for Azure and GCP. BSI C5 compliant, secure, and for public authorities.
IT Baseline Protection Meets the Cloud
IT Baseline Protection is not limited to on-premises environments. Its principles are universal, but implementation in the cloud requires a new way of thinking. The Shared Responsibility Model is key. Who is responsible for what? This question must be answered clearly.
For the public sector, cloud migration means reinterpreting IT Baseline Protection. The building blocks do not change, but the way the requirements are met does. Automation and cloud-native tools play a central role.
The Shared Responsibility Model in Detail
Cloud Provider (e.g., Azure, GCP): Responsible for the security of the cloud. This includes the physical security of data centers, the security of the virtualization layer, and the basic infrastructure.
Customer (Authority): Responsible for security in the cloud. This includes service configuration, identity and access management, data protection, and operating system patching.
IT Baseline Protection consulting helps to define this demarcation clearly. The BSI-compliant cloud security concept documents it.
Implementing Baseline Protection Building Blocks in the Cloud
OPS.1.1.5: Logging
Azure: Azure Monitor, Log Analytics, Microsoft Sentinel
Implementation: Use hub-and-spoke or VPC peering. Enforce network segmentation. Activate DDoS protection.
Quick Checklist: IT Baseline Protection in the Cloud
Baseline Protection Building Block
Cloud Tool (Azure Example)
Implemented?
ORP.4 (IAM)
Entra ID, PIM
☐
CON.1 (Crypto)
Key Vault, TDE
☐
OPS.1.1.5 (Logging)
Log Analytics, Sentinel
☐
NET.1.1 (Network)
VNet, NSGs, Firewall
☐
SYS.1.1 (Server)
Azure Policy, Defender for Cloud
☐
DER.1 (Secure Development)
Azure DevOps Security
☐
To-Do List for Cloud Baseline Protection
Week 1: Understand and document the Shared Responsibility Model.
Week 2: Conduct a cloud-specific risk analysis.
Month 1: Create a mapping of Baseline Protection building blocks to cloud services.
Month 2: Build a landing zone with Baseline Protection configurations (Policy-as-Code).
Month 3: Centralize logging and monitoring.
Ongoing: Monitor compliance status with cloud tools (e.g., Defender for Cloud).
The Role of BSI C5
BSI C5 and IT Baseline Protection are complementary. BSI C5 is a requirements catalog specifically for cloud services. Many C5 requirements can be met directly with Baseline Protection measures. Anyone implementing IT Baseline Protection in the cloud is well on their way to BSI C5 compliance.
The BSI-compliant cloud security concept should integrate both frameworks. It demonstrates how the requirements of C5 and Baseline Protection are met through technical and organizational measures in the cloud.
Insight42: Your Partner for Cloud Security
We translate IT Baseline Protection for the cloud. We show you how to operate Azure and GCP securely and compliantly. Our IT Baseline Protection consulting is specialized for cloud scenarios.
We build secure landing zones that incorporate ISO 27001 and BSI C5 requirements from the start. With Cloud Managed Services, we ensure ongoing secure operations.
Make your cloud Baseline Protection-compliant. Talk to us.
Figure: Implementing IT Baseline Protection Principles in a Cloud Architecture
AI In The Public Sector, Resilience, Sovereignty Series 9th Feb 2026Martin-Peter Lambert
Cloud Migration Roadmap for the Public Sector – The Path to Digital Sovereignty
Meta Description: Learn how public authorities can develop a successful Cloud Strategy & Migration Roadmap (Multi-Cloud). Achieve BSI C5 compliance with a sovereign cloud and a federal multi-cloud strategy.
Why Public Authorities Need a Cloud Strategy Now
The digital transformation of public administration is at a turning point. A cloud-first approach is no longer an option; it is a necessity. German authorities must act, and time is of the essence.
A well-designed Cloud Migration Roadmap provides the foundation. It connects technical requirements with regulatory mandates, placing BSI C5 compliance at the core. The ultimate goal is to achieve digital sovereignty in the cloud.
Understanding the Challenge
Public institutions face unique hurdles. A Data Protection Impact Assessment (DPIA) for the cloud is mandatory. IT baseline protection consulting (IT-Grundschutz) must be involved from the start. The procurement of cloud service providers follows strict regulations.
A federal multi-cloud strategy offers flexibility. Azure migration and GCP migration can proceed in parallel. The Cloud Adoption Framework for Azure provides proven methodologies, while Google Cloud migration partners complete the ecosystem.
The 5-Phase Approach to Cloud Migration
Phase 1: Assessment and Analysis
Every successful migration begins with an inventory. What workloads exist? What are the dependencies? Cloud migration consulting provides clarity.
Phase 2: Strategy and Architecture
This is where the actual roadmap is developed. Azure Landing Zone or GCP Landing Zone? Often, the answer is both. Multi-cloud migration enables freedom of choice.
Phase 3: Compliance and Security
BSI C5 cloud requirements are defined. A BSI-compliant cloud security concept is created. ISO 27001 based on IT-Grundschutz forms the basis.
Phase 4: Migration and Implementation
A datacenter migration to Azure is performed step-by-step. A VMware to Azure migration utilizes proven tools. A fixed-price cloud migration offer provides planning security.
Phase 5: Operations and Optimization
Cloud managed services for authorities take over routine operations. Azure managed services ensure availability. Continuous improvement becomes the standard.
Quick Checklist: Cloud Migration Roadmap
Step
Action
Timeline
1
Create Workload Inventory
Week 1-2
2
Document Compliance Requirements
Week 2-3
3
Evaluate Cloud Providers
Week 3-4
4
Plan Landing Zone
Week 4-6
5
Launch Pilot Project
Week 6-8
6
Finalize Rollout Plan
Week 8-10
To-Do List for Decision-Makers
Today: Appoint an internal cloud champion.
This Week: Initiate an IT landscape assessment.
This Month: Commission cloud consulting for public authorities.
Quarter 1: Conduct a BSI C5 gap analysis.
Quarter 2: Prepare the cloud migration tender.
Why Multi-Cloud Makes Sense for Public Authorities
A sovereign cloud in Germany alone is often not enough. Specialized services require flexibility. The German Administration Cloud (Deutsche Verwaltungscloud) can be combined with Azure and GCP.
The advantages are clear: no vendor lock-in and the best solution for every use case. A cloud framework agreement enables rapid procurement.
Cloud migration costs remain predictable. Cloud migration offers can be compared. IT service providers for the public sector understand the requirements.
The Next Step
A professional Cloud Migration Roadmap is complex. It requires expertise in technology and procurement law. Azure migration partners and Google Cloud migration partners bring both.
Insight42 supports public authorities on this journey, from the initial analysis to ongoing operations. BSI C5 compliant, KRITIS cloud security included, and NIS2 compliance consulting as standard.
Ready for the first step? Contact us for a non-binding initial consultation.
Figure: The 5 Phases of Cloud Migration for the Public Sector
Blog Post 2: Multi-Cloud Strategy for the Federal Government – Flexibility Meets Compliance
Meta Description: Federal Multi-Cloud Strategy: Combine Azure and GCP. Implement a cloud-first administration with BSI C5, digital sovereignty, and a cloud framework agreement.
Multi-Cloud is the Future of Public Sector IT
Single cloud providers have their limits. A federal multi-cloud strategy overcomes them. Azure migration and GCP migration complement each other. The result: maximum flexibility with full compliance.
The public sector benefits particularly. Cloud migration for public administration becomes simpler. Specialized workloads find their optimal platform. Digital sovereignty in the cloud is maintained.
What Multi-Cloud Really Means
Multi-cloud is more than just using two providers. It is a strategy, an architecture, and an operating model. The Cloud Adoption Framework for Azure provides the methodology; a GCP Landing Zone provides the structure.
Each workload is analyzed. Where does it run best? Azure? GCP? A sovereign cloud in Germany? The answer is often: it depends.
The Building Blocks of a Multi-Cloud Architecture
Governance Layer
Centralized control is essential. An Azure Landing Zone and a GCP Landing Zone follow common principles: uniform policies, consistent monitoring, and end-to-end security.
Connectivity Layer
An Azure ExpressRoute setup connects data centers. Google Cloud Interconnect complements it. Hybrid scenarios become possible. A datacenter migration to Azure proceeds without interruption.
Security Layer
The BSI C5 cloud standard applies across the board. The BSI-compliant cloud security concept is uniform. IT baseline protection consulting considers all platforms. ISO 27001 based on IT-Grundschutz remains the standard.
Application Layer
This is where multi-cloud shows its strength. Kubernetes runs on both AKS and GKE. Containers are portable. Vendor lock-in is avoided.
Quick Checklist: Multi-Cloud Readiness
Area
Checkpoint
Status
Governance
Central Policy Engine Defined
☐
Network
Connectivity Concept Created
☐
Security
BSI C5 Mapping for All Clouds
☐
Identity
Centralized IAM Planned
☐
Costs
FinOps Process Established
☐
Operations
Multi-Cloud Monitoring Active
☐
To-Do List for Multi-Cloud Success
Immediately: Conduct a cloud strategy workshop.
Week 1: Start workload classification.
Week 2: Create a compliance matrix.
Month 1: Build landing zones in parallel.
Month 2: Migrate pilot workloads.
Month 3: Establish governance processes.
Structuring Tenders and Procurement Correctly
A cloud migration tender requires expertise. The procurement of cloud service providers follows public procurement law. A cloud framework agreement accelerates procurement.
IT service providers for the public sector know these processes. Cloud consulting for authorities begins before the tender. Cloud migration offers are designed to be comparable.
Cloud migration costs vary widely. A fixed-price for cloud migration creates certainty. Azure migration consulting and GCP migration partners work hand in hand.
Compliance as an Enabler
Being BSI C5 compliant is not an obstacle; it is a mark of quality. KRITIS cloud security becomes the standard. NIS2 compliance consulting integrates European requirements.
A Data Protection Impact Assessment (DPIA) for the cloud is mandatory. It protects citizens and the authority. The German Administration Cloud (Deutsche Verwaltungscloud) meets the highest standards.
The Insight42 Approach
We understand multi-cloud. We understand public authorities. We understand procurement law. This combination makes the difference.
From strategy to operations, we offer cloud managed services for authorities as a complete package. Azure managed services and GCP operations from a single source.
Start now. The cloud is not waiting. Neither are your citizens.
Figure: Multi-Cloud Architecture for the Public Sector
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
