Canadian IT sovereignty
Canada’s IT Sovereignty Standard
An independent framework for evaluating the ownership, governance, operational control and strategic alignment of technology service providers supporting Canadian organizations.
?
The central question
Who ultimately owns, governs and controls the technology partner your organization depends upon?
The Foundation
The Goverment of Canada recognizes three dimensions of digital sovereignty
01
Data Sovereignty
Where data resides, under whose laws it operates, and who has jurisdiction and control.
02
Operational Sovereignty
Who controls how digital services are deployed and operated, and whether the organization is dependent upon or exposed to foreign entities.
03
Technological sovereignty
Whether an organization retains the ability to make independent technology decisions without becoming overly dependent upon monopolistic or foreign-controlled vendors.
Resources:
Canada’s IT Sovereignty Standard applies these principles specifically to the strategic technology service-provider relationship
FOR BOARDS & EXECUTIVE LEADERS
Your technology partner is part of your risk environment
For organizations where technology is fundamental to business operations, the ownership and governance of a strategic IT provider can introduce considerations around
These are increasingly enterprise governance and risk considerations, not simply procurement considerations.
Control
Who ultimately controls a critical technology function?
Continuity
What happens if the provider is acquired?
Geopolitical dependency
Could external ownership introduce additional dependency?
Strategic alignment
Whose priorities ultimately determine investment and direction?
Customer priority
Will your organization remain strategically important after consolidation?
Economic impact
Where does the economic value created through the relationship ultimately accrue?
THE MATRIX IS NOT A RANKING
The Matrix does not rank technology providers based on capability, quality, size or customer satisfaction
A provider can be an excellent technology company and still not be Sovereign Compliant.
The Matrix answers a narrower question:
Who ultimately owns and controls this technology partner?
Who ultimately owns and controls this technology partner?
THREE POSSIBLE OUTCOMES
Sovereign Compliant
The available evidence satisfies the applicable Canadian sovereignty criteria.
Not Sovereign Compliant
The available evidence demonstrates material non-Canadian ultimate ownership or control.
Unverified
There is insufficient reliable evidence to make a definitive determination.
Unverified does not mean non-compliant. It means the available evidence is insufficient to make the determination.