Skip to content

Digital Sovereignty Starts at the Network Layer

Why senior leaders should care about who controls their IP address space, and what to do about it.

Audience: isp6 members, CIOs, CTOs, infrastructure directors, heads of architecture, and technology leaders responsible for cloud strategy, business continuity, and regulatory posture.

Last updated: September 2026

1. Introduction: the strategic blind spot

Most organisations have invested heavily in securing their applications, encrypting their data, and negotiating favourable cloud contracts. Yet very few have asked a fundamental question: who actually controls the network identity our entire digital operation depends on?

For the majority of businesses running on public cloud, the answer is their network operator. The IP address space their services announce to the Internet is allocated from the operator's pool, tied to that operator's account, and surrendered the moment the relationship ends. Every DNS record, firewall rule, certificate, and email reputation signal is anchored to addresses that cannot move with you.

This is not a networking detail. It is a strategic dependency.

isp6, a Local Internet Registry and RIPE NCC member, exists so that your organisation does not have to accept that dependency as a fact of doing business on the Internet. There are two ways to hold IPv6 space through isp6, and both are ordered from the same portal.

Provider Aggregatable (PA) space comes with membership. Your organisation orders a /48 or /44 drawn fresh from our RIPE NCC allocation, completes identity verification, and receives a pristine block registered in the RIPE Database within minutes. From that point forward, the block is announced by you, from any network you choose.

Provider Independent (PI) space is assigned to your organisation by the RIPE NCC. The inet6num carries status ASSIGNED PI, is held under your own maintainer, and names isp6 only as the sponsoring LIR. The application is self-service: the justification, the addressing plan, the supporting documents and the agreements are all completed in the portal, and isp6 reviews the package and files it with the RIPE NCC. The RIPE NCC sizes PI against your addressing plan: a /48 for most, and larger only where a single site needs more /64 subnets for its own use than a /48 holds. Several sites are assigned a /48 each, and one application can ask for all of them.

Which one fits depends on why you need it. PA is faster, carries no application, and delivers the portability this article is about, so where fast and uncomplicated is what the job needs, membership is the better fit. RIPE policy asks a PI request for a plan and a justification, and RIPE NCC staff evaluate it, so PI is measured in weeks rather than minutes. It earns that weight when the registration itself has to be in your organisation's name, which is more often a regulatory or contractual requirement than a technical one.

2. Network operator assigned vs. BYOIP via isp6

Dimension Network operator assigned BYOIP via isp6
Vendor lock-in Structural: migration requires re-numbering Eliminated: announce your prefixes from any provider
Business continuity Dependent on single provider's availability Portable across providers, regions, and data centres
IP reputation Inherited and surrendered with each provider change Built on your own clean allocation, held under your own registration
Regulatory posture Dependency on provider's compliance and terms Documented end-user control under a RIPE NCC member LIR
Contract leverage Provider holds switching-cost advantage Symmetric: your addresses move with you
Security controls Delegated to provider's routing and RPKI policies Direct control over ROAs, reverse DNS, and BGP policy

isp6 is a Local Internet Registry and RIPE NCC member. We assign pristine IPv6 address space that you can announce from any network using BYOIP. Self-service, and portable between providers. For organisations that need the registration itself in their own name, we sponsor Provider Independent assignments: that application is self-service in the same portal, and isp6 reviews it and files it with the RIPE NCC. Here's what each risk looks like, and how isp6 addresses it.

3. Vendor lock-in becomes structural

Cloud providers allocate IP addresses from their own pools. Your services, DNS records, allow-lists, and partner integrations accumulate around those addresses. Migrating away means re-numbering your entire network: every DNS zone, firewall policy, SPF record, and ROA entry.

This is not a migration cost. It is a migration barrier, and it gives your incumbent provider leverage in every contract renewal.

Full routing autonomy Configure your own BGP announcements, manage your ROAs for RPKI protection, and set up reverse DNS, all through isp6's subnet dashboard. Your network, your routing policy, your reputation.
Immediate operational use Traditional IP allocation involves paperwork, justification processes, and multi-week lead times. isp6 streamlines this to minutes: provisioned, registered in the RIPE Database, and ready to announce.

4. Reputation is rented, not built

IP reputation, the trust signals that determine whether your email reaches inboxes, your traffic is flagged by threat feeds, and your API calls are rate-limited, is tied to address space. With provider-assigned addresses, you inherit whatever reputation history those addresses carry. You also surrender the reputation you build when you leave.

Organisations that depend on email deliverability, financial processing, or API partnerships cannot afford to treat IP reputation as disposable.

Pristine PA assignments isp6 assigns fresh, never-before-used Provider Aggregatable IPv6 address space from its own RIPE NCC allocation. Your organisation receives a clean block with no inherited reputation issues, registered and maintained with your organisation as the documented end user.

5. Compliance exposure grows with every regulation

The EU's NIS2 Directive, DORA, and evolving cybersecurity frameworks increasingly require organisations to demonstrate control over critical digital infrastructure. Regulators are asking not just where data is stored, but how the network infrastructure that carries it is governed.

An organisation that cannot demonstrate control over its address space may find itself explaining a dependency chain governed by a cloud provider's terms of service rather than the organisation's own policies.

Provider Independent options For organisations that require address space registered directly to them, the PI application is self-service in the isp6 portal: the justification, addressing plan, documents and agreements are completed online, and isp6 reviews the package and files it with the RIPE NCC as your sponsoring LIR. The resulting `inet6num` carries status `ASSIGNED PI` under your own maintainer, and isp6 carries the sponsoring-LIR duties that follow: annual contact validation, abuse-contact upkeep and the registry relationship. There is no exit fee if you move to another sponsor.
ASN provision For organisations announcing their own prefixes, an AS Number runs as the same kind of self-service application, and can be combined with a PI request as one. You supply the routing policy and at least two peering partners in the portal; isp6 reviews and files it, and the AS Number is registered to your organisation with isp6 as the sponsoring LIR.

6. What changes with portable addressing

When your IPv6 allocation comes from isp6 as your LIR rather than your network operator's pool, you can announce those prefixes from any network: AWS, Azure, Google Cloud, a colocation facility, or all four. Multi-cloud and hybrid-cloud strategies stop being theoretical and start being operational.

Business continuity plans gain a real foundation: failover means re-announcing prefixes from a different location, not re-numbering under pressure. Your negotiating position strengthens because your provider knows your addressing isn't tied to their platform. And your security posture improves through direct control over routing policy, ROAs, and reverse DNS.

These are not theoretical benefits. They are operational controls that reduce attack surface, support audit requirements, and shift contract leverage in your favour.

7. Next steps

The shift from operator-locked to portable addressing is not disruptive. It does not require re-architecting applications or changing cloud providers. It is an additive step, one that gives your organisation a stable, portable network foundation that every other infrastructure decision can build on.

isp6 exists to make that step straightforward. Membership is self-service, identity verification is handled in the portal, and your PA assignment is registered in the RIPE Database as soon as onboarding is complete, ready to announce from any network. Where the registration has to be in your own organisation's name, the PI application runs from the same portal and is set out at isp6.net/pi.

8. Further Reading

External References

Take the renumbering risk off the table

Changing provider should not mean renumbering the network. Address space registered to you removes that from the negotiation entirely.

Get your IPv6 space →

This document is provided for informational purposes. Protocol specifications and cloud provider behaviour are subject to change. Consult the linked RFCs and vendor documentation for authoritative, up-to-date information before making architectural decisions.