Enterprise Networking, the layer nobody scores until it fails

Networking is the layer the sovereignty conversation usually skips. The applications get scored, the data platforms get scored, and the network is treated as plumbing. The Commission Cloud

Sovereignty Framework refuses to skip it, and for good reason. The plumbing is where the packets cross jurisdictional boundaries, where the firmware is signed, and where the management plane quietly exports your operational telemetry to a foreign cloud.

Where enterprise networks sit today

Two patterns dominate.

• A large European enterprise running SD-WAN and SASE from one of the dominant US vendors, with cloud-managed controllers hosted in the US or in a US-headquartered European region. This estate typically scores SEAL-1 on SOV-5 and SOV-7, regardless of where the boxes sit physically.
• A European enterprise running campus and data centre networking from a European vendor, with local management, but relying on non-EU firmware in the underlying silicon. This estate can reach SEAL-2 on the operational objectives and stalls on SOV-5 because of the silicon layer.

The SOV objectives that dominate networking

SOV-5, supply chain

This is the objective networking teams underestimate the most. The framework asks where hardware is manufactured, where firmware is signed and updated from, and how visible the sub-supplier chain is.

For most enterprise networks, firmware updates originate outside the EU and are signed by non-EU keys. That is an SOV-5 exposure whether the packets ever leave the country or not.

SOV-7, security and compliance

The Network Operations Center (NOC) and Security Operations Center (SOC) location question is louder in networking than anywhere else, because the operational telemetry the NOC sees, flow records, configuration changes, and topology data, is itself sensitive.

If the NOC sits in a non-EU jurisdiction, that telemetry sits there too, and the framework treats it as data crossing the boundary.

SOV-6, technology

Open standards versus proprietary.

A network built on documented protocols and open APIs is portable.

A network built on a proprietary controller with proprietary telemetry formats is not. The framework rewards the first and penalises the second.

The management plane problem

Cloud-managed networking is the single biggest sovereignty issue in most enterprises today, and the one most likely to be missed.

When a network vendor moves its controller to the cloud, three things happen at once.

• Configuration data leaves the customer premises.
• Telemetry leaves the customer premises.
• Control API endpoints move under the vendor jurisdiction.

The framework does not care that this is convenient. It scores the jurisdictional exposure. A cloud-managed SD-WAN estate with a US-hosted controller is not SEAL-2, no matter what the sales deck says.

There are three defensible positions:

1. Move the controller to an EU-hosted instance, with EU support and EU key custody. Some vendors offer this, some do not.
2. Move to an EU vendor whose controller is EU-hosted by default. This is often a bigger conversation than the estate can absorb in one cycle.
3. Move to a self-hosted controller model on EU infrastructure, accepting the operational overhead. This is often the only route to SEAL-3.

The firmware and signing question

Firmware is where sovereignty debates get uncomfortable, because there is almost no European silicon in the mainstream enterprise networking market.

The framework recognises this and does not demand European silicon at every layer. What it does demand is transparency, audit rights, and control over the update pipeline.

Practical positions that score well:

• An EU-hosted software update repository, controlled by the customer or by an EU integrator, with signed firmware images verified locally.
• A documented sub-supplier list with audit rights, including the geography of the signing keys.
• A contract clause requiring notification of any change in the country of firmware development or signing.

Eight networking questions for your next refresh

1. Where is the management plane hosted, and under whose jurisdiction?
2. Where is operational telemetry stored, and for how long?
3. Which country signs the firmware for each hardware line, and who holds the signing keys?
4. What is the geography of the NOC, and can we contract for an EU-only NOC?
5. Which control APIs are documented and open, and which are proprietary?
6. What is our exit position if the vendor changes its controller hosting jurisdiction mid-contract?
7. Which sub-suppliers appear in the delivery chain, and what audit rights do we have over them?
8. What is the SEAL score we would present to a regulator today, on the criteria the Commission actually uses?

What this means for buyers

The network scores worse than most CIOs think, and the fixes are less painful than a full vendor swap.

Start with the management plane and the firmware update path. Those two changes usually move an estate up one full SEAL level.

Post five walks through the Commission calculator with a small, realistic example so you can start scoring your own estate before your next tender goes out.