Every promising conversation with an operations organisation eventually reaches the same room, and the people in it are not the ones who liked the demo. Nuclear IT and cyber security want to know where the data sits, what direction it moves, and whether the thing you are proposing becomes a Critical Digital Asset.
Answer the pathway question first
Hosting location is not what determines a CDA — function and pathway are. What matters is that the flow is one-way, the deployment is on the business network with no plant OT connection, and the outputs are advisory. Read-only file exports in; no agent, no inbound connection, nothing written back to any system of record.
- Non-safety-related: performs no safety function and is credited for none.
- Never cited in a procedure, so it is not a credited input to a shutdown-risk decision.
- No pathway to any Critical System, by construction rather than by policy.
Let the customer own the tenancy
The default that clears review fastest is deployment into the customer's own cloud tenant. They own the subscription, the region, the keys and the bill. The vendor never holds plant data and never sees dose records. That single decision removes most of the data-residency conversation before it starts.
Where operations are US-persons-only, AWS GovCloud provides FedRAMP High and DoD IL4/IL5. Azure Government reaches the same bar and is the only cloud with a published 10 CFR 810 position, which matters for export-controlled work. Fully on-premise remains available and should be priced and supported as the distinct product it is, rather than sold as a checkbox.
Bring the boundary diagram to the first meeting
The mistake is treating deployment as a later procurement detail. Operations buys the outcome; IT approves the pathway. If the boundary story arrives after enthusiasm has been built, the project stalls in review. If it arrives with the first slide, the review becomes a formality and the pilot starts on schedule.