All industries
In an era of geopolitical tension and shifting data protection rules, institutions must re-evaluate their cloud approach. This article offers a perspective on how to navigate the rising US data access risks and what steps can be taken to adapt to a shifting global landscape.
Recent developments under the current United States administration have amplified ambiguity around its socio-economic trajectory and global positioning. This unpredictability raises several questions around the reliance on cloud services from US-based hyperscalers:
Some of these legal implications are explored in a blog article by David Rosenthal, which also discusses changes in risk and their assessment. At the heart of the growing concern are three key developments – removal of PCLOB members, government access to enterprise data, and legal mandates that undermine contracts.
The new government's attempt to dismiss Democratic members of the Privacy and Civil Liberties Oversight Board (PCLOB) will likely weaken the US-EU/US-CH Data Privacy Framework (DPF) over time. This framework enables data transfers from the EU and the US, ensuring that data is protected according to local regulations, particularly the GDPR. The DPF also includes safeguards, such as limitations on US surveillance, to ensure adequate protection for EU citizens' data.
Given the changing risk landscape, organisations must reassess their technical measures and safeguards.
While the above risks haven’t yet fully materialised, the dynamic geopolitical climate demands that Lawful Access Reviews and Cloud Compliance and Risk Assessments (CCRAs) should be reassessed and updated to remain effective. Current CCRAs are based on FLARA (Foreign Legal Access Risk Assessment), a framework that no longer fully reflects today’s geopolitical realities, meaning that without updates, CCRAs risk being outdated or incomplete.
We recommend that companies, particularly in regulated sectors like finance or critical infrastructure, review and adapt their risk assessments. This means updating technical and organisational measures to address emerging legal and geopolitical risks. David Rosenthal's team has developed an updated FLARA template reflecting this shift.
In parallel, Business Continuity Management (BCM) and cloud exit strategies have become indispensable elements of a modern resilience strategy, and they are now more critical than ever. Our project experience shows that these areas are often addressed superficially, so closing existing gaps and rethinking strategies is now urgent.
Conduct a full review of your CCRA and related documentation for relevance and adequacy. The updated FLARA should be incorporated into these reassessments. These evaluations often surface a wide range of technical and organisational needs for secure and compliant cloud operations.
In many organisations, much of this is already covered by an established security framework. But if that’s not yet the case, there are accessible, practical entry points. The OWASP Cloud Security Cheat Sheet and the Cloud-Native Application Security Top 10 provide clear, actionable guidance to help you build a stronger, more resilient cloud security posture.
BCM is complex and often underestimated. It refers to an organisation’s ability to maintain or rapidly restore critical processes during disruptions, from ransomware attacks to cloud service failures.
While the specific scenarios may differ, the underlying response playbooks tend to overlap. That’s why they must be clearly documented, routinely tested, and continuously improved. We strongly advise you to deal with it at an early stage and in a structured manner.
How well is your company organised in this area?
Ideally, you should be able to answer all the following questions in the affirmative. If not, there is a concrete need for action.
The term "exit strategy" is often dismissed due to alarmist narratives or a reluctance to confront uncomfortable truths. Cloud exits are complicated and expensive due to vendor lock-in and insufficient on-premises capabilities. Not planning for one could be far more costly.
In addition, you should consider potential cloud exit strategies and their specific implementation options at an early stage to be able to act swiftly in the event of an emergency.
Depending on your organisation’s tech maturity, risk appetite, and strategic direction, exit strategies may take very different forms.
We identified three primary exit routes:
Switching to another US hyperscaler or adopting a multi-cloud strategy boosts flexibility, innovation, and scalability, but it comes at a cost.
It demands high cloud maturity, increases complexity, and drives up operational overhead (e.g., staff training). Crucially, reliance on US providers remains, so if your concerns are US policy-driven, this path won’t solve them.
This option is best suited for companies with high technological maturity and established multi-cloud capabilities.
“In times of rising uncertainty, resilient cloud solutions require robust threat models and realistic risk assessments, as well as sustainable mitigation measures such as failover processes to alternative solutions.”
Organisations may believe they are compliant and competitive today, but often only because their risk models haven’t caught up to the new geopolitical reality. In 2025, true compliance and resilience require treating cloud risk as a strategic priority.
At Zühlke, we help customers build sustainably secure cloud solutions. We identify critical gaps, both organisational and technical, and implement the necessary organisational changes. This includes:
Wherever you are on your cloud journey, Zühlke is your partner for building resilient, future-ready solutions.
