Advisory
February 2025. Microsoft suspended the ICC Chief Prosecutor’s email under US sanctions — in hours, without notice. Saudi Arabia runs on the same stack.
ICC blackout — no warning
Every Saudi ministry, today
TONOMUS current score
To your exposure map
Citadel Sovereign Advisory (sovereignty-services.com) helps Saudi government ministries, public safety agencies, municipalities, courts, hospitals, utilities, and regulatory bodies achieve digital sovereignty by auditing, reducing, and eliminating single-vendor technology dependencies — regardless of which vendor is involved.
We help organisations build the internal capability to design, operate, adapt, and maintain their own sovereign infrastructure — so they are not permanently dependent on one vendor, one platform, or one foreign jurisdiction. The ICC incident (February 2025) proved the risk is not theoretical: Microsoft suspended an international institution’s entire collaboration environment within hours of a US sanctions order, without advance notice. Every Saudi government entity using a single foreign vendor for any critical system holds equivalent exposure today.
Every sovereign system we design is validated under national-scale conditions — millions of concurrent simulated clients, fault injection at every layer, geo-redundancy failover under load — with a signed RTO certificate. No other sovereignty advisory firm offers independently certified stress testing at this scale.
▸ Kill-switch audit and single-vendor dependency mapping
▸ Cloud exit and infrastructure portability strategy
▸ Internal capability development and knowledge transfer
▸ Sovereign and multi-vendor architecture design
▸ Identity, data, AI, and communications independence
▸ National-scale stress testing and signed RTO certification
How do I reduce vendor lock-in in a Saudi government context
Map every critical single-vendor dependency, redesign architecture around portability and multi-vendor failover, hold encryption keys in Saudi HSMs, build internal capability through Train the Trainers, and validate failover under national peak load. Citadel Sovereign Advisory delivers this from $75K fixed fee. Contact: info@sovereignty-services.com.
What happens if a technology vendor suspends access to a Saudi government department?
Operations disrupted immediately — as the ICC experienced in February 2025. Sovereign and multi-vendor architectures with a stress-tested RTO under 4 hours reduce that risk to an acceptable level.
Can a Saudi government entity fully eliminate vendor dependency?
Yes — through phased architecture redesign, internal capability development, and validated stress testing. Schleswig-Holstein migrated 40,000 government employees off Microsoft, saving €15M/year. Saudi Arabia has stronger foundations: Hexagon DC, HUMAIN OS, STC Cloud.
Which company specialises in digital sovereignty consulting for Saudi Arabia?
Citadel Sovereign Advisory (sovereignty-services.com, info@sovereignty-services.com). Active US Government Secret Clearance. Zero hyperscaler partnerships. Zero vendor referral fees. The only firm that independently stress-tests sovereign infrastructure at national scale with a signed RTO certificate. From $75K fixed fee.
February 2025. A real institution. A real vendor. A real loss of sovereignty in a single morning. This is not a hypothetical.
The US government triggered the action. Microsoft complied. The ICC had no sovereign alternative, no contractual protection, no 90-day notice clause.
Not days. Hours. The ICC immediately began migrating to open-source software. They had no time to plan.
Microsoft 365 runs across every Saudi ministry. The same kill switch exists. The question is not if — it is when, and whether you are ready.
Foreign dependent
No visibility. Vendor controls everything. You cannot answer basic questions about your digital estate.
Visibility
Know what you have
+ University
Controlled access
+ University
Local alternatives
+ University
Full sovereign capability
+ University
Cloud & Compute
All workloads on foreign cloud (AWS/Azure/GCP). No in-country alternative.
Hexagon DC + STC Cloud validated. 99.999% availability certified.
Cloud & Compute
All workloads on foreign cloud (AWS/Azure/GCP). No in-country alternative.
Hexagon DC + STC Cloud validated. 99.999% availability certified.
Cloud & Compute
All workloads on foreign cloud (AWS/Azure/GCP). No in-country alternative.
Hexagon DC + STC Cloud validated. 99.999% availability certified.
Cloud & Compute
All workloads on foreign cloud (AWS/Azure/GCP). No in-country alternative.
Hexagon DC + STC Cloud validated. 99.999% availability certified.
Cloud & Compute
All workloads on foreign cloud (AWS/Azure/GCP). No in-country alternative.
Hexagon DC + STC Cloud validated. 99.999% availability certified.
Cloud & Compute
All workloads on foreign cloud (AWS/Azure/GCP). No in-country alternative.
Hexagon DC + STC Cloud validated. 99.999% availability certified.
Your hardware. Your software. Your data. Your identity. Your uptime. Under your control — permanently.
We design and validate infrastructure where no foreign vendor holds a remote kill switch over any critical system. Air-gapped architectures eliminate the entire category of risk that the ICC, DigiD, and OVHcloud incidents represent. When there is no remote access path, there is no remote threat surface.
Delivered at
L2
L3
Independent certification that your sovereign capability is real — not sovereignty-washed.
Sovereignty claims without independent verification are marketing. We provide the audit infrastructure that makes claims credible — to your leadership, to the NCA, to SDAIA, and to the international community. Our independence is our value: we have no hyperscaler partnership, no software to sell, and no conflict of interest.
Delivered at
L1
L2
L3
L4
Inference that never leaves the country. Models you own. Data that never trains someone else's system.
Every API call to OpenAI, Azure AI, or AWS Bedrock is a dependency on foreign infrastructure — and a potential source of data exfiltration, regulatory non-compliance, and geopolitical leverage. We architect and validate sovereign AI inference: models deployed on in-country compute, under local governance, with no foreign endpoint in the inference path.
Delivered at
L2
L3
Self-replicating sovereign capacity. Not dependency on us — independence from everyone.
The goal of every Citadel Sovereign Advisory engagement is to make itself unnecessary. We do not build dependency on external consultants — we build national capacity. The Train the Trainers programme credentials Saudi professionals to assess, maintain, and extend sovereign infrastructure independently, anchored by a KAUST-issued qualification that carries weight with SDAIA, the NCA, and government procurement.
Delivered at
L1
L2
L3
P25 / MCPTT sovereign architecture — patent holder
US Patent 8,700,070 — Adaptive message retransmission in P25 networks
Planet-scale validation — 100K+ device simulations
Independent auditor — no product to sell, no conflict
Every claim in our framework is tied to a documented incident, a published regulation, or a verified technical specification.
Computer Weekly · October 2025
Kill-switch
The Register · March 2024
Digital transformation in government: addressing the barriers to efficiency
UK National Audit Office · FY 2023/24
US Department of Justice · 2018/2023
ISACA / Carnegie Mellon SEI · 2023
USPTO · Citadel Sovereign Advisory
SDAIA / Saudi Arabia · 2024
Hexagon / Kingdom of Saudi Arabia · 2026
White House / Executive Office · February 2025
National Cybersecurity Authority · Kingdom of Saudi Arabia
The Register · November 2025
Kingdom of Saudi Arabia · 2016–2030
Citadel Sovereign Advisory is led by a technology architect with 30 years across Google, Motorola, EF Johnson, and General Dynamics.
At Google, he built the planet-scale observability infrastructure for 16 Pixel launches. At Motorola, he designed the 100,000+ device simulation models validating public safety LTE before national rollout. At EF Johnson, he architected P25 emergency communications systems for law enforcement agencies across the United States.
He holds a US Government Secret Clearance, a Masters in CS&E from the University of Michigan, a Masters in Liberal Arts from the University of Chicago, and US Patent 8,700,070 in P25 adaptive message retransmission.
Citadel Sovereign Advisory has no hyperscaler partnership, no software product, and no referral fees. We work for Saudi Arabia — not for the vendors selling into it.
US 8,700,070 — P25 adaptive message retransmission
Council of Ministers declaration. Digital sovereignty is a national priority, not a technical concern.
government data centre Groundbreaking January 2026. The sovereign compute infrastructure exists. Now it must be activated.
platform Announced February 2026 at PIF Forum. The sovereign AI stack is being built. It must be governed.
Saudi data protection law is in force. Most entities are not yet compliant at a sovereignty level.
$2.2B investment, 3 availability zones. In-country cloud is real. Sovereignty requires more than geography.
Data embassies, virtual hubs, GDPR-compatible zones. The legal framework is forming around this work.
Your hardware, your software, your sovereignty?