questions.js

// EU Cloud Sovereignty Framework Assessment Questions
// Converted from questions.yml
// Version: 1.0
// Based on: EU Cloud Sovereignty Framework (Version 1.2.1, October 2025)

const assessmentData = {
    objectives: [
        {
            id: "strategic",
            name: "Strategic Sovereignty",
            code: "SOV-1",
            description: "Strategic Independence & Corporate Control",
            weight: 15,
            max_score: 150,
            questions: [
                {
                    id: "q1.1",
                    text: "Where is your organization legally registered and primarily controlled?",
                    type: "multiple_choice",
                    options: [
                        { label: "EU/EEA Member State", score: 30 },
                        { label: "Non-EU country with strong EU ties (e.g., Switzerland)", score: 21 },
                        { label: "Non-EU/Non-EEA country (e.g., USA, China)", score: 0 },
                        { label: "Multiple jurisdictions", score: 15 }
                    ]
                },
                {
                    id: "q1.2",
                    text: "Is your organization free from control by non-EU parent companies?",
                    type: "yes_no",
                    multiplier: 3
                },
                {
                    id: "q1.3",
                    text: "What percentage of your board/executive team are EU citizens?",
                    type: "multiple_choice",
                    options: [
                        { label: "75-100%", score: 30 },
                        { label: "50-74%", score: 21 },
                        { label: "25-49%", score: 12 },
                        { label: "0-24%", score: 0 }
                    ]
                },
                {
                    id: "q1.4",
                    text: "Is your organization free from significant foreign investment that could influence strategic decisions?",
                    type: "yes_no",
                    multiplier: 3
                },
                {
                    id: "q1.5",
                    text: "Are your critical infrastructure components (servers, data centers) owned/operated by EU entities?",
                    type: "yes_no",
                    multiplier: 3
                },
                {
                    id: "q1.6",
                    text: "Can your organization make strategic decisions without approval from non-EU entities?",
                    type: "yes_no",
                    multiplier: 3
                }
            ]
        },
        {
            id: "legal",
            name: "Legal & Jurisdictional Sovereignty",
            code: "SOV-2",
            description: "Legal Protection & Jurisdiction",
            weight: 10,
            max_score: 100,
            questions: [
                {
                    id: "q2.1",
                    text: "Are your cloud service agreements governed exclusively by EU law?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q2.2",
                    text: "Are you protected from extraterritorial laws (e.g., US Cloud Act, FISA)?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q2.3",
                    text: "How do you handle non-EU government data access requests?",
                    type: "multiple_choice",
                    options: [
                        { label: "Reject all non-EU requests without EU court approval", score: 15 },
                        { label: "Assess case-by-case with legal review", score: 10 },
                        { label: "Comply based on mutual legal assistance treaties", score: 5 },
                        { label: "Comply with all requests", score: 0 }
                    ]
                },
                {
                    id: "q2.4",
                    text: "Is your service fully GDPR compliant with regular audits?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q2.5",
                    text: "Do you have legal representation and registered offices in EU jurisdictions?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q2.6",
                    text: "Are all disputes resolved in EU courts under EU law?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q2.7",
                    text: "Do you have an EU-based Data Protection Officer (DPO)?",
                    type: "yes_no",
                    multiplier: 1
                }
            ]
        },
        {
            id: "data_control",
            name: "Data & AI Sovereignty",
            code: "SOV-3",
            description: "Data Location & Processing Control",
            weight: 10,
            max_score: 100,
            questions: [
                {
                    id: "q3.1",
                    text: "Where is your customer data stored?",
                    type: "multiple_choice",
                    options: [
                        { label: "Exclusively in EU/EEA", score: 15 },
                        { label: "Primarily EU/EEA with encrypted backups elsewhere", score: 10 },
                        { label: "Multiple regions including non-EU", score: 5 },
                        { label: "Non-EU locations", score: 0 }
                    ]
                },
                {
                    id: "q3.2",
                    text: "Is all data processing (including analytics, ML) performed exclusively within the EU/EEA?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q3.3",
                    text: "Are all backups stored within EU/EEA territories?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q3.4",
                    text: "Where are encryption keys stored and managed?",
                    type: "multiple_choice",
                    options: [
                        { label: "EU-only with customer-controlled HSM", score: 15 },
                        { label: "EU-only with provider-managed HSM", score: 10 },
                        { label: "Multi-region with EU primary", score: 5 },
                        { label: "Non-EU key management", score: 0 }
                    ]
                },
                {
                    id: "q3.5",
                    text: "Do you provide contractual guarantees for data residency within EU/EEA?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q3.6",
                    text: "If data leaves EU/EEA, do you use adequacy decisions or approved transfer mechanisms (SCCs)?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q3.7",
                    text: "Are logs, metadata, and telemetry data also stored exclusively in EU/EEA?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q3.8",
                    text: "Can customers choose specific EU countries for data residency?",
                    type: "yes_no",
                    multiplier: 1
                }
            ]
        },
        {
            id: "operational",
            name: "Operational Sovereignty",
            code: "SOV-4",
            description: "Operational Personnel Control",
            weight: 15,
            max_score: 150,
            questions: [
                {
                    id: "q4.1",
                    text: "Where are system administrators with production access located?",
                    type: "multiple_choice",
                    options: [
                        { label: "Exclusively EU/EEA-based", score: 15 },
                        { label: "Primarily EU/EEA with vetted exceptions", score: 10 },
                        { label: "Global with EU oversight", score: 5 },
                        { label: "No geographic restrictions", score: 0 }
                    ]
                },
                {
                    id: "q4.2",
                    text: "Is customer support handling sensitive data performed by EU-based personnel?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q4.3",
                    text: "Do all personnel with data access undergo EU-standard background checks?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q4.4",
                    text: "Are privileged access controls in place to prevent unauthorized data access by staff?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q4.5",
                    text: "Is remote access from non-EU locations restricted or monitored?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q4.6",
                    text: "Do staff receive regular training on EU data protection and sovereignty requirements?",
                    type: "yes_no",
                    multiplier: 1
                }
            ]
        },
        {
            id: "supply_chain",
            name: "Supply Chain Sovereignty",
            code: "SOV-5",
            description: "Supply Chain Transparency",
            weight: 20,
            max_score: 200,
            questions: [
                {
                    id: "q5.1",
                    text: "What is the origin of your critical hardware components (CPUs, GPUs, storage)?",
                    type: "multiple_choice",
                    options: [
                        { label: "EU-manufactured or EU-vetted suppliers", score: 15 },
                        { label: "Mix of EU and trusted international suppliers with transparency", score: 10 },
                        { label: "International suppliers with limited transparency", score: 5 },
                        { label: "Unknown or non-transparent supply chain", score: 0 }
                    ]
                },
                {
                    id: "q5.2",
                    text: "Do you maintain detailed documentation of your technology supply chain?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q5.3",
                    text: "Have you identified and assessed all third-party dependencies for sovereignty risks?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q5.4",
                    text: "Do you perform sovereignty assessments on critical vendors and suppliers?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q5.5",
                    text: "Do you have alternative EU-based suppliers identified for critical components?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q5.6",
                    text: "Are supply chain security measures in place (e.g., hardware verification, secure boot)?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q5.7",
                    text: "Do you publish transparency reports on your supply chain and dependencies?",
                    type: "yes_no",
                    multiplier: 1
                }
            ]
        },
        {
            id: "technology",
            name: "Technology Sovereignty",
            code: "SOV-6",
            description: "Technological Openness & Independence",
            weight: 15,
            max_score: 150,
            questions: [
                {
                    id: "q6.1",
                    text: "What percentage of your core infrastructure uses open-source technologies?",
                    type: "multiple_choice",
                    options: [
                        { label: "75-100%", score: 15 },
                        { label: "50-74%", score: 10 },
                        { label: "25-49%", score: 5 },
                        { label: "0-24%", score: 0 }
                    ]
                },
                {
                    id: "q6.2",
                    text: "Are you free from critical dependencies on proprietary non-EU technologies?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q6.3",
                    text: "Do you use open standards and protocols (e.g., OpenAPI, FHIR, etc.)?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q6.4",
                    text: "Can customers export all their data in open, standard formats without vendor lock-in?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q6.5",
                    text: "Does your service support interoperability with other cloud providers and platforms?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q6.6",
                    text: "Is your source code available for audit or open-sourced?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q6.7",
                    text: "Are all APIs fully documented with open specifications?",
                    type: "yes_no",
                    multiplier: 1
                }
            ]
        },
        {
            id: "security",
            name: "Security & Compliance Sovereignty",
            code: "SOV-7",
            description: "Security & Compliance Assurance",
            weight: 10,
            max_score: 100,
            questions: [
                {
                    id: "q7.1",
                    text: "What security certifications do you hold?",
                    type: "multiple_choice",
                    options: [
                        { label: "ISO 27001, SOC 2, and EU-specific certs (e.g., ENS, BSI)", score: 15 },
                        { label: "ISO 27001 and SOC 2", score: 10 },
                        { label: "Basic security certifications", score: 5 },
                        { label: "No formal certifications", score: 0 }
                    ]
                },
                {
                    id: "q7.2",
                    text: "Do you comply with EU cybersecurity frameworks (e.g., NIS2, Cyber Resilience Act)?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q7.3",
                    text: "Do you have an EU-based incident response team available 24/7?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q7.4",
                    text: "Do you use EU-approved encryption standards and algorithms?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q7.5",
                    text: "Are you subject to regular third-party security audits by EU-based firms?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q7.6",
                    text: "Do you have a formal vulnerability management and disclosure program?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q7.7",
                    text: "Do you comply with GDPR breach notification requirements (72-hour reporting)?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q7.8",
                    text: "Do you have automated compliance monitoring for EU regulations?",
                    type: "yes_no",
                    multiplier: 1
                }
            ]
        },
        {
            id: "sustainability",
            name: "Environmental Sustainability",
            code: "SOV-8",
            description: "Environmental Sustainability",
            weight: 5,
            max_score: 50,
            questions: [
                {
                    id: "q8.1",
                    text: "What percentage of your data center energy comes from renewable sources?",
                    type: "multiple_choice",
                    options: [
                        { label: "75-100%", score: 15 },
                        { label: "50-74%", score: 10 },
                        { label: "25-49%", score: 5 },
                        { label: "0-24%", score: 0 }
                    ]
                },
                {
                    id: "q8.2",
                    text: "Do you measure and optimize Power Usage Effectiveness (PUE)?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q8.3",
                    text: "Are you carbon neutral or have committed to carbon neutrality?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q8.4",
                    text: "Do you publish regular sustainability and environmental impact reports?",
                    type: "yes_no",
                    multiplier: 1
                },
                {
                    id: "q8.5",
                    text: "Do you align with EU Green Deal objectives and circular economy principles?",
                    type: "yes_no",
                    multiplier: 1
                }
            ]
        }
    ]
};