Part 2 — From Fiction to Action: Building the EU Plan B – Geopolitics Pressured Us — Business Continuity Protected Us
The day after the chaos, the company’s war room is quieter — not because the problem is solved, but because the message has finally sunk in.
Geopolitics was a debate topic yesterday; today it’s an urgent procurement plan.
The board has authorized a supplier exit project, with one clear mandate:
“Within 90 days, we must have a fully operational, EU-hosted alternative to Microsoft 365 that keeps our people working and our data sovereign.”
“Trump Introduces ‘Out of Office…’ Sanction — EU Companies Face Digital Lockout”
In a surprise press conference, former US president Donald Trump announced a fictitious new policy — the “Out of Office” directive — barring EU companies from accessing critical US cloud services “until trade terms are renegotiated.”
Within hours, the digital shockwave rivaled the chaos of WannaCry:
• European companies found themselves locked out of Microsoft 365 and SharePoint
• Cross-border teams lost access to documents mid-meeting
• Compliance teams scrambled to respond to data availability breaches
While the story is fictional, the risk scenario is real — NIS2’s operational resilience principles tell us to expect the unexpected and remove single-jurisdiction dependencies.
From Dependency to Digital Sovereignty: Nextcloud + ONLYOFFICE
Nextcloud Hub has emerged as a credible, EU-sovereign SharePoint alternative, hosted entirely within EU/EFTA data centers or on-prem.
Combined with ONLYOFFICE integration, organisations can achieve:
- Full co-authoring experience for Word/Excel/PowerPoint formats
- Advanced version control: retrieve, compare, or restore any document iteration
- Compliance with NIS2: EU-hosted, GDPR-aligned, with audit trails and retention policies
- Workflow automation: review/approval flows without US-based intermediaries
Qfirst Statement on Recommended SaaS Solutions
The SaaS solutions presented in this analysis were selected solely on the basis of their alignment with operational resilience objectives and compliance with applicable regulatory requirements, including NIS2 supply chain and data sovereignty provisions.
Qfirst has no commercial interest, sponsorship, or affiliate relationship with any of the named vendors. The proposed setup is shared to foster constructive discussion, encourage balanced evaluation of outcomes, and provide insight into the potential business impact of residual risks.
Our objective is to enable decision-makers and stakeholders to clearly identify where existing strategies meet resilience goals and where additional mitigation measures may be warranted.
Why This Matters for NIS2
Annex II & Annex III stress resilience of digital infrastructure providers
Article 21 calls for supply chain risk management — removing extra-territorial jurisdictional risk is a prime exampl
Article 23: incident reporting — with EU-based Nextcloud hosting, forensic evidence remains in-jurisdiction
Implementation in Phases — The 90-Day Nextcloud Wave Plan
Below is a simplified visual wave plan for migrating from SharePoint to Nextcloud + ONLYOFFICE:
Wave 1 (Days 1-30) ██████████████ Pilot: HR + Compliance sites (critical workflows, retention policies)
Wave 2 (Days 31-60) ████████████████████ Sales + Marketing libraries (collaboration heavy, external sharing)
Wave 3 (Days 61-75) ██████████████ Project spaces + engineering docs (versioning, large file sets)
Wave 4 (Days 76-90) ██████████████ Remaining departments + archive migration, SharePoint read-only
Key Steps in Each Wave:
1. Inventory & permissions audit
2. Metadata mapping to Nextcloud tagging/labels
3. ONLYOFFICE integration (co-authoring + templates)
4. Version history migration (preserving document evolution)
5. User training & adoption sessions
6. Backup/restore verification for resilience assurance
The Strategic Payoff
By the end of the 90 days:
- All content resides in EU-controlled infrastructure
- Co-authoring and version history match — and in some cases exceed — SharePoint’s usability
- Legal, operational, and regulatory resilience against sudden third-country service lockouts is demonstrably stronger
- NIS2 compliance posture improves, with supply chain dependency risks reduced
Internal auditor – What is your task as advisor?
A sharp comparison of ONLYOFFICE vs. O365, spotlighting its strengths.
Insights into the recent ownership controversy (original Russian ties) and current state.
A spotlight on deploying Nextcloud + ONLYOFFICE on fully EU-based Hetzner infrastructure.
A back-of-the-envelope cost estimate for 500 users.
ONLYOFFICE vs O365 — A Quick Comparison
Feature ONLYOFFICE (with Nextcloud) Microsoft 365 (O365)
Office Apps Real-time co-authoring via ONLYOFFICE (Docs, Sheets, Slides) integrated in Nextcloud
Resource: de.wikipedia.org, forum.cryptpad.org, popacloudhost.com, hetzner.com
Fully featured Word, Excel, PowerPoint with integrated Teams, Outlook
Versioning & Audit Built-in version history, track/restore revisions (de.wikipedia.org)
Sophisticated versioning, advanced compliance tools (e.g. retention, DLP)
Collaboration Nextcloud Talk for chat/video; only office for editing (en.wikipedia.org, popacloudhost.com) Teams for chat, meetings; integrated across suite
Deployment Open-source, self-hostable in EU infra (e.g. Hetzner) SaaS with data hosted primarily in MS’s global cloud
Control & Sovereignty Full EU control, GDPR friendly Subject to US law and cross-border access requests
Pricing Lower TCO (no license fees, just hosting + support) Higher licensing cost per user per month/year
Bottom line: ONLYOFFICE combined with Nextcloud delivers strong document collaboration, version control, and audit capabilities, all while giving you full data sovereignty and the ability to host entirely in the EU—unlike Microsoft 365’s dependency on US cloud infrastructure.
Ownership & Sanctions Update what about the ONLYOFFICE Russian Ties?
Conclusion: While initial ties to Russia are well-documented and have caused real-world business discontinuities, the 2023 corporate shift has materially reduced direct Russian ownership. That said, for highly regulated environments or risk-averse institutions, additional due diligence or temporary sandboxes may still be warranted.
Deploying Nextcloud + ONLYOFFICE on Hetzner — Fully EU Hosted
“The Office Suite with a Past”
When the IT team proposed ONLYOFFICE as the EU-friendly replacement for Microsoft 365, it seemed like the perfect fit:
✅ Runs on our own servers in the EU
✅ Works inside Nextcloud
✅ Looks and feels like the tools people already know
But then hardened CISO of the compliance team asked a question:
“Where exactly does this software come from?”
The paper trail started in Latvia, at Ascensio System SIA. That looked fine — an EU address, EU laws. But dig deeper, and older records showed a connection to a Russian company, New Communication Technologies.
In 2022, when the war in Ukraine broke out, the ties became a problem for some customers. One Ukrainian provider publicly cut all business with ONLYOFFICE, citing the link and the company’s silence on the conflict.
In 2023, the ownership structure shifted. A British parent company appeared, itself owned by a Singapore holding. The official story: this was just a corporate consolidation of global branches. The effect: no more direct Russian corporate ownership.
For some this can be enough to move forward. For others, the trust damage and assurance of investment is gone — they need stronger guarantees, independent code audits, and clear governance.
Lesson:
In the age of NIS2 and supply chain security, an office suite isn’t just a productivity tool — it’s part of your critical infrastructure. Knowing its history matters as much as knowing its features.
Why Hetzner for DATA storage ?
Hetzner provides GDPR-compliant servers located in Germany and Finland, with transparent pricing and hourly/monthly billing options.
Hetzner offers Managed Servers: from about €34/month, with pre-configured LAMP stack and support services—ideal if you’d rather not manage low-level infrastructure.
All data centers reside in Germany and Finland, ensuring full EU sovereignty
Quick install guide: Hetzner community offers tutorials for installing ONLYOFFICE Docs on Nextcloud — simplifying deployment of the full suite (community.hetzner.com).
Estimated Cost for 500 Users (Annual)
The logical Option : Managed Dedicated Server
One server: approx €34–€37/month → €408–€444/year.
Additional Costs:
Support / Maintenance: If internal staff manage, near-zero incremental cost; else allocate ~€10-€20/user/year for outsourced support.
Backup & High Availability: Optional backup storage/HA add-ons (~€100–€200/year).
ONLYOFFICE Enterprise License (optional): depends on scale; if required, budget separately.
Total Approximate Annual Cost:
• Hosting: ~€450/year
• Optional Support / HA: €5,000–€10,000/year
• Total (500 users): ~€10–20/user/year — significantly lower than Microsoft 365 licensing.
From “Out of Office… Wannacry” to EU Sovereignty — Nextcloud + ONLYOFFICE on Hetzner: A NIS2-Ready SharePoint Alternative
Its a Management decision : Business Context & Risk Scenario
A fictional “Out Of Office Wannacry” shutdown of US cloud services underscores the urgent need for EU-native alternatives—central to NIS2 resilience.
ONLYOFFICE vs O365
Integrated with Nextcloud, ONLYOFFICE matches Word/Excel/PowerPoint collaboration, adds robust versioning, and avoids US jurisdiction—everything O365 delivers, without lock-in.
Ownership Update
Previously Russian-linked, ONLYOFFICE underwent a 2023 restructuring, shifting parentage to British company and Singapore holding. While that reduces direct Russian control, some scrutiny persists in sensitive sectors.
EU Deployment via Hetzner
Deploying Nextcloud & ONLYOFFICE on Hetzner’s fully EU datacenters gives you true data sovereignty. Setup is straightforward, well-documented, and cost-effective.
Cost Snapshot
Hosting ~500 users costs around €450/year for infrastructure. Including support, total TCO is ~€10–20/user/year, far below typical O365 licensing.
Create a 360 degree evaluation in 3d not a 2D
Here’s an executive summary that distills the technical details of the Exit plan into leadership-level language, framed with risk assessment and CAPA (Corrective & Preventive Actions) principles from START² RISK³D.
Executive Summary — Securing Nextcloud Talk for EU-Sovereign, End-to-End Communication
Scenario: To comply with NIS2 and maintain resilience against state-level surveillance (e.g., Chinese network interception), we must ensure all Nextcloud Talk communications—video, audio, files—are end-to-end encrypted and hosted entirely within the EU.
Strategic Approach:
- Enable End-to-End (E2E) calls in Talk and ensure all clients support it.
- Host the signaling server and media relays (HPB & TURN) on EU-based infrastructure (e.g., Hetzner Germany/Finland).
- Store files in E2E-encrypted folders—so even the server cannot read them.
- Harden infrastructure, clients, and identity systems with EU-only access controls.
This ensures content stays encrypted from device to device and no third-country provider can access communications.
Residual Risk:
After mitigations, residual risk is Low-Medium (mainly endpoint security, which remains a user-side dependency).
Corrective & Preventive Actions (CAPA)
Corrective Actions (fix existing gaps):
1. Deploy HPB and TURN in EU (Hetzner) — remove foreign relay dependence.
2. Enable Talk E2E calls and upgrade all clients to compatible versions.
3. Lock chat retention to minimal periods; move sensitive files to E2E folders.
Preventive Actions (avoid recurrence):
1. Quarterly security reviews of Nextcloud Talk and relay configs.
2. Annual red-team exercises on signaling & TURN infrastructure.
3. Vendor risk re-assessment for EU infrastructure providers.
4. User training on secure endpoint practices and E2E limitations.
Key Benefits
• NIS2 alignment — addresses supply chain and data sovereignty risks.
• EU sovereignty — no media/data path crosses outside EU jurisdiction.
• Compliance evidence — documented mitigations, vendor risk register, CAPA logs.
• Operational continuity — resilient against extra-territorial service bans.
———
Internal auditor do a realistic Risk Assessment — with the START² RISK³D Lens
Keep your eyes open — “Five Ways Your EU Cloud Talk Can Still Betray You”
When the board approved the move to Nextcloud Talk as part of the O365 exit plan, there was relief in the air. “We’re sovereign now,” people said. But as the internal risk team soon discovered, sovereignty is not the same as invulnerability.
1. The Foreign Relay That Listens In
Even with servers in the EU, media traffic can sometimes bounce through relays far from home. If that relay is in a non-EU jurisdiction, your confidential meetings are just a subpoena away.
Risk: High
Mitigation: Self-host the High Performance Backend (HPB) and TURN servers inside EU data centers under your control.
2. The Call Without a Lock
End-to-end encryption (E2E) is like a sealed meeting room. Without it, your video and audio can be intercepted mid-flight.
Risk: Medium
Mitigation: Enforce E2E calls and block non-compliant clients that don’t support it.
3. The Chat That Lives Forever
Your chats are stored on the server. If the server is breached, so is your conversation history.
Risk: Medium
Mitigation: Move sensitive exchanges to E2E-encrypted file shares and set short retention policies for chat messages.
4. The Metadata Spy
Even if the call is encrypted, the “outside of the envelope” — who you called, when, and how long — can reveal patterns of your business.
Risk: Medium
Mitigation: Host all TURN/STUN infrastructure in the EU, keep logs minimal, and enforce short retention.
5. The Compromised Device
The weakest link is often the user’s own laptop or phone. Once compromised, keys and decrypted content are wide open.
Risk: High
Mitigation: Enforce device compliance, full-disk encryption, and multi-factor authentication.
Moral of the Story:
Switching to EU-hosted tools is a powerful step, but without end-to-end encryption, local control of relays, strict retention, and hardened endpoints, sovereignty can be an illusion.
For 50 critical users and processes, securing Nextcloud Talk with EU-sovereign hosting, E2E calls, and EU-only relays is not expensive—especially when compared to the potential operational, compliance, and reputational damage of a foreign service outage or state-level interception.
Cost Context
Infrastructure: On Hetzner or similar, this setup would likely cost €200–€400/year for a small HA setup.
Setup/Maintenance: 2–4 days of internal admin time or 1–2 days of EU vendor time/year.
Licenses: Only applicable if you choose ONLYOFFICE enterprise edition; community edition is free.
Training: ~2 hours/user initial training + refreshers.
Conclusion: For NIS2-regulated organisations, this should be treated as core Business Continuity—just like backup power or redundant connectivity. The risk mitigation and sovereignty benefits far outweigh the low cost and effort.
Key Points from the Article for a Supplier Exit Plan Template
You can use these as mandatory clauses & action points in your Supplier Exit / Plan B section of your Business Continuity Plan.
1. Clear Exit Triggers
– Political sanctions affecting supplier jurisdiction (e.g., US, China).
– Loss of compliance alignment (e.g., NIS2, GDPR).
– Supplier ownership changes increasing risk (e.g., foreign control with geopolitical risk).
– Security incidents with unresolved CAPA.
2. Alternative EU-Sovereign Supplier Identified
Primary alternative: Nextcloud Hub + ONLYOFFICE on EU infrastructure (Hetzner/OVH/Scaleway).
All core collaboration functions must be replicated (chat, meetings, file sharing, versioning).
3. Pre-Agreed Technical Readiness
Maintain up-to-date deployment documentation and config scripts (Ansible/Terraform).
Keep TURN/STUN, HPB, and app server configs ready for activation.
Maintain DNS switch playbook to redirect traffic to alternate infrastructure within hours.
4. Data Export & Migration Path
Ensure supplier provides open, exportable formats (no lock-in).
Schedule quarterly export tests (mail, docs, metadata).
Keep last full export in secure EU storage.
5. Security & Compliance Criteria
Alternative must meet current Annex II/III NIS2 requirements.
All hosting and media relays must be EU/EFTA-based.
E2E call capability mandatory; E2E file storage for sensitive content.
6. Roles & Responsibilities
Assign a Supplier Exit Coordinator.
Pre-identify EU vendor contact for rapid activation.
Maintain a decision matrix for go/no-go cutover.
7. Testing & Review
Annual tabletop exercise simulating supplier cut-off.
Validate cutover time against RTO/RPO objectives.
Post-exercise review with CAPA updates.
CEO & C-Level Management Conclusion
The “Trump Digital COVID” scenario underlines one truth: geopolitics is not an abstract risk — it’s a boardroom responsibility.
An O365 lockout is not simply an IT inconvenience; it is a business continuity crisis that can paralyze communication, sales, and compliance in hours.
The companies that emerge unscathed will be those that:
- Actively map dependencies on foreign jurisdiction suppliers.
- Maintain a tested, documented Plan B with fully operational EU-based alternatives.
- Align supplier governance with NIS2 supply chain resilience requirements.
Your leadership role is to demand evidence of resilience — not just reports with green status lights. Ask for tabletop exercise results, activation time metrics, and documented cutover procedures.
Internal Auditor Conclusion
For internal auditors, this scenario is a live-fire drill in paper form.
It demonstrates the gap between policy compliance and operational readiness:
- Supplier risk registers must go beyond contract clauses — include exit playbooks.
- Test readiness quarterly with role-play exercises and measure RTO/RPO performance.
- Treat identity services (e.g., Azure AD) as critical infrastructure in supplier risk scoring.
- Use the START² RISK³D framework to assess residual risks post-mitigation, especially around endpoints, encryption, and jurisdiction.
In short: audit the plan, then audit the execution.
Other Business-Critical Applications to Consider in a “Trump Digital COVID” Lockdown
Beyond Microsoft 365, a sudden US-imposed cloud shutdown could impact:
- Identity & Access Management
- Azure Active Directory (AAD)
- Okta (US HQ)
- Ping Identity
- CRM & Sales Platforms
- Salesforce
- HubSpot
- ERP & Financial Systems
- Oracle NetSuite
- SAP (if hosted in US hyperscalers)
- Collaboration & Messaging
- Slack (Salesforce-owned)
- Zoom
- Webex (Cisco)
- DevOps & Source Control
- GitHub (Microsoft)
- Atlassian Cloud (Jira, Confluence hosted outside EU)
- Marketing & Analytics
- Google Analytics / Ads
- Marketo (Adobe)
- Support & Ticketing
- Zendesk
- Freshdesk
- Cloud Storage & Backup
- AWS S3 / EFS
- Google Drive
- Dropbox
Auditor’s Note: Any dependency on US-based SaaS without an EU-hosted, jurisdiction-controlled fallback is a single point of failure. These should be included in your Supplier Exit Plan alongside O365.
