For most of the last decade, European organizations handled two questions on separate tracks. The first was about sovereignty: where does our data live, and whose laws apply to it? That question usually belonged to legal, compliance, and procurement. The second was about resilience: if we are attacked, can we recover? That one belonged to the security and infrastructure teams.
The two groups had different budgets, different vendors, and different definitions of success. But that separation no longer holds.
Over the past eighteen months, regulators have started asking both questions in the same review, and attackers have shown that a recovery plan is only as strong as the infrastructure it depends on. The result is a single requirement we call sovereign cyber resilience: the ability to protect data, recover from an attack, and keep operating on infrastructure that stays within a boundary you control, both legally and operationally.
What Organizations Mean by Sovereignty
Sovereignty has become a crowded word, so it helps to be precise. In our conversations with European customers, it usually breaks into two parts:
Data sovereignty covers where data is stored and processed and who is allowed to access it.
Operational sovereignty covers whether an organization can keep running and recover inside its own borders during a crisis, and whether it has enough independence and visibility to avoid relying blindly on a single foreign provider.
When customers turn those ideas into requirements, three requests come up more than any others; they want data (and metadata) to stay within local boundaries, they want control over encryption keys, and they want a clear audit trail of who accessed their data and systems, including the provider's own staff.
The legal backdrop explains why these requests have sharpened. The US CLOUD Act allows US authorities to require US technology companies to produce data in response to a valid warrant, regardless of where that data is stored. That can sit uneasily alongside GDPR's limits on transferring personal data out of the EU.
Customers have responded by asking harder questions about jurisdiction, and the public sector is leading. In its 2026 digital sovereignty research, Capgemini found that 27% of public sector organizations have already implemented a digital sovereignty strategy and another 48% are actively developing one.
Regulators Now Want to Know Where Recovery Happens
National laws implementing NIS2 are now in force across most of the EU. The directive covers 18 sectors, up from seven under the original NIS Directive. DORA has applied to EU financial entities since January 17, 2025, and supervisors such as BaFin in Germany, DNB and the AFM in the Netherlands, and the ACPR in France have moved from issuing guidance to conducting reviews.
This expansion means that auditors are no longer satisfied with a policy document stating that backups exist. They want to know where recovery copies are physically stored, who operates the systems that hold them, and what happens to the recovery plan if access to infrastructure outside the EU is disrupted. Each of those is a sovereignty question and a resilience question at the same time, and each needs a single answer.
Budgets are following the questions. Gartner forecasts that European spending on sovereign cloud infrastructure will rise from $6.9 billion in 2025 to $12.6 billion in 2026, an increase of 83%, and will reach $23.1 billion in 2027, overtaking North America. Most of that demand comes from the public sector, regulated industries, and critical infrastructure operators, which are the same organizations facing the closest scrutiny under NIS2 and DORA.
Attackers Are Aiming for Disruption
In the meantime, ransomware has not slowed down. Check Point recorded 824 ransomware attacks in September 2026 alone, 53% more than in September 2025. Sophos's State of Ransomware 2026 report puts the median ransom payment at $769,000 and the average cost of recovery, excluding the ransom, at $1.7 million.
The bigger shift is in who is attacking critical infrastructure and why. The Waterfall Threat Report 2026 found that attacks by nation states and hacktivists doubled in 2025, with most of them aimed at critical infrastructure. Overall incidents with physical consequences fell by 25% that year, but only because ransomware activity dipped temporarily. The motives of these two groups are very different. A criminal gang wants a payment, so it has a reason to leave your systems recoverable. A state-backed group may want the grid offline or a hospital unable to open patient records, and it has no reason to leave anything recoverable at all.
That changes how security leaders have to think about prevention. Well-resourced attackers with time and political cover will eventually get through, so the controls that matter most are the ones that determine how quickly and cleanly an organization can restore operations afterward. The World Economic Forum's Global Cybersecurity Outlook 2026 found that 61% of organizations see the rapidly evolving threat landscape and emerging technologies as the biggest obstacle to strengthening their resilience.
Put plainly, many security leaders are unsure whether their recovery plans would hold up against the attacks they now expect.
What Sovereign Cyber Resilience Requires
When sovereignty and resilience are treated as one requirement, four properties matter:
Immutability built into the architecture: Recovery copies have to survive an attacker who has stolen administrator credentials or compromised the hypervisor. If immutability is a setting that a privileged user can switch off, an attacker with the same privileges can switch it off too.
Residency across the whole boundary: Keeping backup data in the EU accomplishes little if the metadata, logs, or management plane that govern it sit somewhere else. Regulators increasingly treat metadata, such as user details, configuration data, and records of who did what, as part of the data they care about.
Control and transparency: Organizations want to decide who holds the encryption keys and who can access their systems, and they want an audit trail that shows every privileged action, including any taken by the provider. Control without visibility is hard to prove to an auditor.
Independence: A recovery plan that depends on reaching infrastructure in another jurisdiction during a geopolitical crisis carries a risk that most organizations have never tested. Sovereign cyber resilience means being able to restore operations even when those external connections are unavailable.
Few organizations need all four at full strength for every workload. A bank's core ledger, a city council's records, and a manufacturer's ERP system will each land in a different place, which is why the deployment model matters as much as the technology.
Two Paths to the Same Standard
No single architecture is right for every organization, which is why Rubrik built Rubrik Security Cloud Sovereign as a portfolio of deployment models that share the same core capabilities.
Rubrik Security Cloud Private (RSC-P) runs entirely within the customer's own perimeter, either on-premises or in a customer-controlled private cloud, and it supports fully air-gapped environments. The organization owns the infrastructure, holds the keys, controls every point of access, and has no dependency on any hyperscaler. For defense programs, operational technology, sensitive government workloads, and organizations whose legal teams require complete independence from any cloud provider, that level of control is the requirement itself.
Many organizations are also moving workloads to the cloud and would rather not run control plane infrastructure themselves. For them, Rubrik Security Cloud is now available on the AWS European Sovereign Cloud. AWS opened the European Sovereign Cloud in January 2026, with its first region in Brandenburg, Germany. AWS describes it as physically and logically separate from its other regions and operated by EU residents. With Rubrik running there, the Rubrik Security Cloud control plane moves inside that boundary, backup data stays on the customer's own Rubrik clusters, and cloud-first teams get immutable backups, sensitive data discovery, and rapid recovery as SaaS, with customer data kept in the EU.
In practice, many organizations will run both. They may keep their most sensitive systems on RSC-P while protecting cloud workloads in the AWS European Sovereign Cloud, all under one consistent protection model. The deployment model should follow the data, the regulatory profile, and the organization's cloud maturity.
Questions to Answer Now
Whichever path you choose, three questions will show how close you are to sovereign cyber resilience.
Can your recovery copies survive a privileged attacker? If someone with administrator credentials could delete or encrypt your backups, those backups will not protect you when it counts.
Where does your recovery infrastructure actually run, and who can see and change it? Look beyond the contract to the physical location of the systems, the people with access to them, who holds the encryption keys, and the legal jurisdiction that governs all of it. Include metadata, logs, and the management plane in that review, along with the data itself, and ask whether you could produce an audit trail of every privileged action.
Could you recover if connectivity outside the EU were cut off tomorrow? If the answer depends on reaching a system in another jurisdiction, that dependency belongs on your risk register and in your next tabletop exercise.
Organizations that can answer all three with confidence are in a strong position for their next NIS2 or DORA review. Those that cannot still have time to close the gap, and they have more ways to close it today than they did a year ago.
Rubrik Security Cloud Sovereign delivers sovereign cyber resilience across multiple deployment models. Rubrik Security Cloud Private (RSC-P) supports on-premises and air-gapped environments under full customer control, and Rubrik Security Cloud on AWS European Sovereign Cloud is a SaaS control plane option that supports workloads inside the EU sovereign boundary. To learn more, register for our upcoming webinar on 17 November.