CISPE criticizes BSI's C3A criteria as insufficient for cloud sovereignty (heise.de)

• CISPE criticizes C3A: No protection against US laws due to subcontractor clause
• Source code escrow requirement disadvantages European SMEs
• BSI defends catalog as strategic stress test for US hyperscalers

"The European cloud association CISPE accuses the German BSI of creating only apparent sovereignty with its C3A criteria catalog. The rules allow US hyperscalers as subcontractors and do not protect against extraterritorial laws like the US Cloud Act. Additionally, the bureaucratic burden disadvantages European SMEs, while large projects like SAP/Microsoft Delos are favored."