It is not just a matter of storing files reliably and ensuring they are accessible. Equally important are controllable access, traceable authorisations and the integration of the solution into existing security and data protection frameworks.

Data storage as part of the security strategy

Storage and collaboration platforms are a key component of the IT infrastructure. Accordingly, they must be incorporated into an organisation’s security strategy and assessed against the same standards as other business- or security-critical systems.

Inadequately protected systems can facilitate data breaches, unauthorised access or the loss of important information. For operators of critical infrastructure, selecting a suitable solution is therefore also a strategic decision.

Data protection and information security requirements

Organisations in the KRITIS sector require platforms that can be integrated into existing security and operational frameworks and that support the implementation of regulatory requirements.

The relevant criteria include, amongst others:

• GDPR-compliant data processing
• controlled access and authorisation schemes
• traceable approvals and changes
• transparent data processing
• flexible operating and hosting models
• integration of existing identity services
• measures to protect against data loss
• availability and reliability tailored to specific requirements

Particularly where security requirements are heightened, it is important that organisations retain control over their data and the infrastructure they use.

Digital sovereignty as a selection criterion

When selecting a storage and collaboration solution, the location of data processing and the provider’s legal framework play a role alongside technical criteria. If data is processed outside Europe or if a provider is additionally subject to non-European legal systems, further legal and organisational assessments may be required.

Regulations such as the US Cloud Act, for example, raise the question of under what conditions public authorities can demand access to data. Such aspects should therefore be included in the assessment of a platform.

In this context, digital sovereignty encompasses more than just the location where data is stored. The operating model, the components used, existing dependencies and control over access rights are also relevant.

Open source as the basis for control and integration

OpenCloud is an open-source platform for file management and collaboration. The publicly available source code enables organisations and independent bodies to carry out technical audits of the software in use. Security mechanisms, data flows and the components used thus remain fundamentally traceable and do not have to be assessed solely on the basis of a manufacturer’s specifications.

The open approach also facilitates adaptation to different technical and organisational requirements. Open standards and documented interfaces support integration into existing infrastructures and can reduce dependencies on individual providers or proprietary ecosystems.

OpenCloud can be operated in an organisation’s own data centre, in a private cloud or as a SaaS offering from partners. This allows organisations to choose an operating model that suits their requirements for data management, administration and organisational framework.

Security requires more than just the right software

For operators of critical infrastructure, the software used is always only one part of the security architecture. The key lies in the interplay between technology, configuration, the operating environment and organisational measures. An open and flexible solution such as OpenCloud can help to technically implement requirements relating to data sovereignty, integration and secure collaboration.

How OpenCloud implements these requirements from a technical perspective is explained in our →security whitepaper.