Wombat Wombat

BSI C3A

C3A is the BSI's non-binding criteria catalogue for digital sovereignty in cloud services. It is structured around six sovereignty categories: strategic, legal and jurisdictional, data, operational, supply chain and technology.

Run the scorecard → Open the sovereignty hub Official C3A publication (BSI) ↗ All compliance hubs
  • BSI C3A:2026 · Criteria enabling Cloud Computing Autonomy · published 27 April 2026
  • 3 related frameworks
  • 4 Wombat pillars
  • Last reviewed 31 Oct 2026

Why this matters now.

C3A was published by the BSI on 27 April 2026. It provides transparency criteria for digitally sovereign cloud use, is based on the EU Cloud Sovereignty Framework (EU CSF), and presupposes compliance with C5. The dashboard currently maps WAF-SOV-010 (Data Residency & Geolocation) and WAF-SOV-020 (Encryption Key Management) to the C3A data and jurisdictional dimensions; use that as a starting point and verify the exact criteria in the official catalogue.

What the regulation asks for.

A practical reading of the obligations that usually end up in architecture, operations and evidence reviews.

Obligation

Strategic sovereignty (SOV-1)

The provider's strategy, governance and decision-making must support sovereign cloud use and be transparent to customers.

Obligation

Legal and jurisdictional sovereignty (SOV-2)

Jurisdiction, ownership, legal exposure and the provider's ability to resist extraterritorial access requests must be assessable.

Obligation

Data sovereignty (SOV-3)

Data classification, residency, processing locations, encryption and key management determine who can access the data and under which law.

Obligation

Operational, supply-chain and technology sovereignty (SOV-4–SOV-6)

Operational independence, supplier dependencies, SBOM/hardware transparency, source-code escrow and exit capability are part of the sovereignty picture.

Where Wombat helps.

Each obligation maps to one or more pillars. The pillar pages show the controls, principles and evidence expectations behind the score.

WAF-SOV

Sovereign

The primary mapping: WAF-SOV-010 and WAF-SOV-020 are relevant to the data, jurisdictional and technology sovereignty categories.

Read the Sovereign pillar →
WAF-SEC

Security

Encryption, key custody and access boundaries are the technical core of the data and technology categories.

Read the Security pillar →

Control themes to review.

These are the control themes teams usually need to evidence. The controls catalogue is the authoritative source for the exact control-level mapping.

Strategic sovereignty Legal and jurisdictional sovereignty Data sovereignty and residency Operational sovereignty Supply-chain sovereignty Technology sovereignty Encryption and key management Evidence and auditability
STEP 1

Confirm the C3A scope and the six sovereignty categories in the official BSI publication.

STEP 2

Review the dashboard's current WAF-SOV-010/020 mapping as a starting point, then verify the exact C3A criteria.

STEP 3

Score the Sovereign pillar and collect residency, jurisdiction and key-management evidence.

STEP 4

Export the evidence for provider, procurement or audit conversations.

Related frameworks and evidence.

Wombat controls carry tags for the frameworks below. Use them to connect the technical baseline to the evidence your auditor or procurement team already expects.

BSI C5 EU Cloud Sovereignty Framework (EU CSF) ISO 27001:2022

Make the C3A sovereignty claim verifiable

Score the sovereign baseline, then connect the official C3A categories to the controls and evidence you can actually produce.

Run the scorecard → Open the sovereignty hub

Wombat is a technical framework, not a law firm. These pages map relevant Wombat pillars and control themes to regulatory obligations; they do not provide legal advice. Validate the mapping against the official text and your auditor.

Related compliance hubs.

The same control baseline usually has to satisfy more than one obligation. Jump to the adjacent hub and reuse the evidence.

EU cybersecurity directive

NIS2

NIS2 raises the baseline for cybersecurity risk management, incident reporting and supply-chain accountability across essential and important entities in the EU.

Open the NIS2 hub →
EU digital operational resilience

DORA

DORA brings ICT risk management, incident reporting, resilience testing and third-party oversight into one operational-resilience regime for financial entities and their critical providers.

Open the DORA hub →
German cloud compliance catalogue

BSI C5

The BSI Cloud Computing Compliance Criteria Catalogue (C5) is the German benchmark for cloud security, transparency and auditability — and a common procurement requirement for cloud providers and their customers.

Open the BSI C5 hub →
Control, not just location

Sovereignty

Residency, jurisdiction, key ownership, supplier concentration and exit paths — turned into controls a team can assess.

Open the sovereignty hub →