Exit Readiness

What's changed?

On 29 May 2026, the government adopted Sweden's first cloud policy for public administration. The message is clear: government agencies, municipalities, and regions must be able to move data and switch providers without unnecessary obstacles. The ability to quickly switch solutions is highlighted as especially important in the event of serious geopolitical events and cybersecurity incidents.

At the same time, the new cybersecurity law (NIS2 in Swedish law) took effect on 15 January 2026. It covers 6,000–8,000 organizations, requires documented operational continuity and supplier security, and places personal responsibility on the board, with sanctions of up to €10 million.

In the financial sector, DORA already requires documented and tested exit strategies for critical IT suppliers. Researchers, including Carl Heath and colleagues at RISE, are unanimous: Europe's digital sovereignty is an urgent security issue.

In other words, exit readiness has gone from "nice to have" to a requirement.

The problem: all your eggs in too few baskets

Nearly all critical infrastructure — from email and collaboration platforms to case management and payment systems — today depends on a handful of global cloud providers. It's efficient and convenient. But it also means that a single outage, breach of contract, or geopolitical decision can bring an entire operation to a halt.

Most organizations have never asked themselves the simple but uncomfortable question: What happens if the system isn't there tomorrow? Can we still communicate, make decisions, make payments, and serve our citizens and customers?

But the dependency doesn't stop at the cloud. Even in-house systems are often entirely dependent on a single, often non-European, supplier: directory services and file servers, identity and login (Active Directory / Entra ID), operating systems, databases, and the operations themselves all rest on that same supplier's licenses, updates, and support. Unfortunately, on-prem is not the same as independence. That's why we look at all critical IT-supported operations — not just cloud services.

Exit readiness isn't about abandoning the cloud. It's about packing the parachute before you need it.

Exobe Exit Readiness

We help you build digital freedom to act — legally, technically, and organizationally. The result is a concrete, tested exit plan that holds up when it matters, and that meets the requirements of the cloud policy, the cybersecurity law, and DORA.

What you get:

• Dependency mapping – which business-critical processes depend on which cloud services, and what happens if they disappear?
• Business impact and prioritization analysis (BIA) – RTO/RPO requirements per function, so you know what needs to be restored first and how fast.
• Fallback solutions per service – concrete alternative ways of working for communication, documents, email, and core systems.
• Exit and continuity plan – a ready-made playbook with roles, triggers, decision paths, and step-by-step instructions.
• Exercises and ongoing management – tabletop exercises and continuous revision so the plan stays alive.

We are completely vendor-neutral. This is your plan, built around your requirements and your risk appetite. Not around any single technology.

Our methodology

We work according to a structured, ISO 22301-based methodology built on two principles:

Everything that's critical, not just the cloud. We look at all critical IT-supported operations, regardless of whether the threat is a cloud outage, a network failure, a supplier going bankrupt, or a legal obstacle.

The right level of process. We go only as deep as needed to make the plan actionable. Pragmatism over perfection.

The entire process is built on a three-level continuity model; Normal/Standby, Incident, and Crisis — and follows five steps:

1. Why? Regulations (NIS2, DORA, the cloud policy, GDPR) and the three continuity levels set the framework.
2. What? We start from the needs of each function and prioritize. The result is your MBCO (Minimum Business Continuity Objective) — ISO 22301's term (clause 3.28) for the minimum acceptable level of services and products during a disruption. MBCO is broken down into your minimum viable IT environment (which systems, cloud and on-prem, are required) and into the full chain of recovery requirements: critical functions and systems → MTPD/MAO → RTO → RPO.
3. How? We solve each function's MBCO at each level and secure the three cross-cutting functions that underpin everything: communication, storage, and identity and access.
4. Implement. We introduce parallel systems and fallback solutions, establish and train routines, and test crisis scenarios.
5. Maintain. Annual and ongoing review based on needs, regulations, risks, and conditions: update, test (selectively), and communicate. The plan stays alive.

Related services

Contact oss

Are you interested in the offer? Please fill in the form below and one of our experts will get in touch with you shortly.