For years, much of the discussion about digital sovereignty has centred on a straightforward question: where is the data?
But as governments and highly regulated organisations become increasingly dependent on cloud platforms, interconnected technology supply chains and artificial intelligence, that definition is no longer enough.
Speaking on the second episode of InnovationAus.com’s new Resilience through Capability podcast series, TechnologyOne’s head of security and compliance, Chris Polkinghorne, said data residency remained important, but represented only one layer of the sovereignty equation.
“When people hear sovereignty, they tend to think: my data is in Australia, so I’ve ticked the box. But sovereignty is much broader than that,” he said.
Digital sovereignty now extends to who can access and administer systems, the jurisdictions governing those activities, the suppliers sitting behind a service, and how much operational control an organisation retains.
“Every service is built on layers of other services,” Mr Polkinghorne said.
“You need to understand that supply chain, map out those dependencies and understand the rules that apply at every layer. Ultimately, it comes down to the governance and trust you can place across the whole environment.”
The rapid adoption of AI has made many of these questions more urgent.
“AI is rapidly bringing questions to the surface that organisations have always had to answer,” Mr Polkinghorne said.
“People suddenly want to know: where is my AI model running? What does it have access to? Is it learning from my data? Is that data enriching some other service? AI has made those questions much harder to ignore.”
At the same time, AI is becoming an increasingly useful cyber defence tool. Cybersecurity has always involved dealing with enormous quantities of information about systems, users, vulnerabilities and threats – meaning “cyber has always been a data problem,” according to Mr Polkinghorne.
“You are fundamentally protecting data, but in doing that you generate enormous amounts of information about what is happening across your environment. The challenge has always been distilling that down into something actionable.”
Established cybersecurity frameworks remain useful because their underlying principles have not changed.
“At the heart of all of these frameworks, the fundamentals are still the same: know your assets, understand the controls protecting those assets and take action to get the risk down to the level your organisation is prepared to accept.”
But the threat environment continues to evolve quickly. Stolen credentials or access tokens can give attackers a direct route into systems, increasing the importance of multi-factor authentication, passkeys and other phishing-resistant approaches.
Mr Polkinghorne argues organisations also need to move towards more adversary-led resilience: understanding how attackers operate, identifying the systems and information they are most likely to target, and continually testing resilience against those methods.
“Once you start thinking about the organisation from the adversary’s perspective, you can focus your effort on the areas that genuinely matter.”
This is important because not every part of an organisation carries the same level of exposure.
“One of the weaknesses of checkbox compliance is that everything can end up being treated equally,” he said.
“But organisations don’t work like that. Some areas hold more sensitive data, some are more exposed, and some are much more important to keeping the organisation operating. You need to quantify that and put more attention where it matters.”
Supply chain risk is becoming one of the most consequential parts of this equation, particularly as governments focus more closely on resilience within critical infrastructure.
Mr Polkinghorne said supplier questionnaires and certifications can be useful, but only when connected to the business processes they are supposed to protect.
“Whether it’s a SOC 2 report, an ISO 27001 certification or a security questionnaire, it needs to connect back to the business process that depends on that supplier,” he said.
“You have to look end-to-end at the process and understand the dependency. Otherwise, you can complete an enormous compliance exercise that feels like you are treating the problem but delivers quite limited value.”
Attackers are also increasingly targeting those dependencies.
“Attackers are incredibly efficient at finding routes through supply chains,” Mr Polkinghorne said.
“We see them targeting software development practices, support processes and other upstream services because they know that can give them access downstream.”
The sovereignty debate also extends beyond individual organisations.
TechnologyOne is an Australian-headquartered software developer with its research and development base in Brisbane, and Mr Polkinghorne argues government procurement can help build deeper technology capability locally.
“If you support local industry, you help grow local industry,” he said.
“Where there is R&D and software being built in Australia, government procurement can have a real flow-on effect. As governments invest, they help grow that ecosystem naturally.”
Data location remains part of the equation, but genuine resilience requires organisations to understand the systems, people, suppliers and jurisdictions on which their operations depend.
As Mr Polkinghorne put it: “Sovereignty is much more than where the data lives. It is about understanding all of the layers you depend on and whether you can genuinely trust them.”
Resilience through Capability is an InnovationAus.com podcast series produced in partnership with TechnologyOne.
Do you know more? Contact James Riley via Email.