Turn sovereignty findings into a board-level risk brief

I am [role] at a [sector, for example Dutch healthcare, municipal or defence-adjacent] organisation. These are our findings about whether we can keep access to data, operate and change the surrounding systems, and leave or replace suppliers, including the evidence and unknowns: [findings].

Scope: service or release [version], deployment [profile], operating model [description], relevant agreements and governance [details], customer-control boundary [boundary] and review date [date]. Remove organisation-identifying vulnerabilities and confidential evidence, or use an approved private or local assistant.

Act as a risk-literate CISO briefing a non-technical board. Keep each material dependency and uncertainty visible, even when several findings share a theme. Distinguish practical control from data-compliance questions that need qualified review and data-ethics concerns that customer governance should discuss.

For every material gap or uncertainty:
1. State the concrete operational failure as "if [supplier or event], then we cannot [action]".
2. Separate supplied evidence from assumptions and unknowns. Do not treat missing or outdated evidence as reassurance.
3. Describe the business impact—financial, continuity, regulatory and reputational—and when it would become material.
4. Give the smallest action that would reduce the risk, what evidence would show it worked, and what it does not fix.

Do not let a strong point hide an unrelated dependency or infer legal compliance. Do not produce an overall sovereignty score, badge, legal or ethical verdict, or certification.

Then write a five-sentence summary a board member could repeat verbatim in plain business language. End with the three questions the board should put to IT leadership next quarter.
---
Use the toolkit as a practical way to examine who can possess, use and dispose of data and the software, hardware and organisational arrangements around it. Keep weak points visible instead of hiding them in one overall judgement.
Examine the organisational side through two complementary perspectives. Data compliance covers applicable rules, contracts, policies, authority, duties and supplier commitments. Data ethics asks whether choices are proportionate, fair, transparent and explainable. Governance operates across both.
Keep compliance questions and data-ethics concerns separate. Leave applicability and legal interpretation to qualified counsel, and do not present ethical considerations as a certification or universal verdict.
Scope every conclusion to the described service, deployment, operating model, agreements, customer boundary and date. Separate supplied facts from assumptions and missing or conflicting evidence. Do not produce an overall score, legal or ethical verdict, or certification.
Data handling: do not include personal data, credentials, secrets or confidential contractual, security or architecture details. Redact them and use an approved private or local assistant when redaction is insufficient.
Background and definitions: https://hoist-it.nl/toolkit
Relevant concepts: https://hoist-it.nl/toolkit/data-sovereignty  https://hoist-it.nl/toolkit/the-four-layers  https://hoist-it.nl/toolkit/data-compliance  https://hoist-it.nl/toolkit/data-ethics