The modern operational environment in Ukraine presents unprecedented challenges for IT leaders. Constant cyber and physical attacks on critical infrastructure, along with tightening regulatory requirements, particularly the full implementation of NBU Resolution No. 99, are forcing CIOs, CTOs, CISOs, and enterprise architects to critically reassess their cloud data hosting strategies. The primary tension lies between the need to comply with strict data sovereignty and localization requirements in Ukraine and the use of geographically distributed infrastructure from global cloud providers to achieve higher resilience and disaster recovery capabilities.
Data Sovereignty and the Ukrainian Regulatory Landscape
The concept of data sovereignty is fundamental to national security and economic stability. In Ukraine, this issue has gained particular urgency. The Constitution of Ukraine defines the protection of sovereignty and territorial integrity as the most important functions of the state. Information sovereignty, as a component of state sovereignty, must guarantee the development and protection of the national information space.
A key document regulating the use of cloud services for financial institutions is NBU Board Resolution No. 99 of August 25, 2025 (with full implementation effective May 1, 2026). This resolution formalizes cloud usage in the regulated financial sector, allowing organizations to utilize IaaS, PaaS, SaaS, and SECaaS cloud services, including within private, community, and hybrid models.
However, cloud service users are obligated to comply with Ukrainian legislation regarding the protection of personal and other data. Resolution No. 99 requires banks to clearly define responsible personnel for the implementation and use of cloud services, monitor provider access to restricted information, and track cloud data events, including cyber incidents and outages. The provider, in turn, must meet international security standards and provide annual independent compliance certification. Importantly, Resolution No. 99 prohibits the engagement of cloud service providers that are residents of the aggressor state or have such beneficiaries, as well as those that process or store data in the occupied territories of Ukraine.
Resilience and Recovery Challenges in Wartime
Under the conditions of full-scale war, Ukrainian enterprises face unique threats that require a review of traditional approaches to business continuity and disaster recovery (BCP/DR). Physical attacks on data centers and infrastructure, as well as large-scale power and communication outages, make local data hosting in Ukraine vulnerable.
Global cloud providers offer geographically distributed infrastructure with data centers in dozens of regions around the world. This allows for the creation of highly available and fault-tolerant architectures that can withstand localized disasters. The benefits of cloud-based Disaster Recovery include rapid restoration, as cloud solutions provide tools for recovery from a "warm" site, unlike traditional loading from a "cold" one. This significantly impacts RTO (Recovery Time Objective) and RPO (Recovery Point Objective) metrics, which are key to backup planning.
The shorter the RTO or RPO, the higher the cost of the process. For critical systems, the RPO can be measured in minutes, while for less important data, an acceptable RPO can be up to 24 hours. Global providers invest significant funds in security and fault tolerance, which is difficult and expensive to provide at a local level.
Analytical Framework for Decision Making
Choosing the optimal cloud data geography requires comprehensive analysis. For Ukrainian enterprises, especially those subject to NBU regulation, this process must account for both compliance and operational resilience. We propose the following analytical framework:
- RTO/RPO Goals: Define the maximum allowable downtime (RTO) and data loss (RPO) for each critical system and dataset. This will help assess the required level of resilience.
- Regulatory Compliance: Evaluate how chosen hosting options align with NBU Resolution No. 99 and other Ukrainian data protection laws. Ensure the provider is not a resident of the aggressor state.
- Threat Landscape: Analyze current cyber and physical threats to your infrastructure. Consider risks associated with localized attacks and outages.
- Vendor Lock-in Risks: Assess potential dependency on a single cloud provider and the costs of potential future migration.
- Cost Implications: Compare the Total Cost of Ownership (TCO) for different resilience architectures, including infrastructure costs, licenses, personnel, and potential losses from downtime.
- Shared Responsibility Model: Clearly understand the division of security responsibility between your organization and the cloud provider.
Cloud Data Hosting Strategies: Ukrainian, Global, or Hybrid Cloud
Ukrainian enterprises have several primary strategies for hosting their cloud data:
Ukrainian Cloud: Hosting data in data centers within Ukraine. Benefits include full control over infrastructure and data, compliance with internal regulatory requirements, and predictable technical specifications. However, this carries risks related to physical attacks and large-scale infrastructure outages during wartime.
Global Multi-Regional Clouds: Using services from international providers (e.g., AWS, Microsoft Azure, Google Cloud) with data hosted in geographically distributed regions outside of Ukraine. This ensures high resilience, rapid disaster recovery, and access to a wide range of innovative services. However, questions arise regarding data sovereignty, jurisdiction, and information control, as well as potential vendor lock-in risks.
Hybrid Approach: This model combines local infrastructure, a private cloud, and/or public cloud services. A hybrid cloud allows for keeping sensitive data within the country to comply with legal requirements while simultaneously leveraging global cloud advantages for scaling, backup, and disaster recovery. This enables flexible load distribution, cost optimization, and gradual IT infrastructure modernization. Hybrid multi-cloud architecture is becoming the standard for Ukrainian business, aiming to increase the speed, flexibility, and reliability of IT solutions.
Conclusion
The decision regarding cloud data geography for Ukrainian business is complex but critically important. It requires a balanced approach that considers both regulatory requirements for data sovereignty and the practical necessity of ensuring business continuity and rapid recovery under current threats. Applying an analytical framework that covers RTO/RPO goals, compliance, the threat landscape, vendor lock-in risks, and cost implications will allow IT leaders to make informed decisions. Regardless of the chosen strategy—Ukrainian cloud, global multi-regional clouds, or a hybrid approach—the key is to create a resilient, secure, and flexible architecture that supports the viability and development of the Ukrainian enterprise.
