Technological independence requirements for critical information infrastructure determine which areas of digital transformation within the industrial ecosystem of the nuclear industry the orchestrator may open to external participants and which must remain closed. Platform openness research frames openness as the sponsor’s choice between fostering innovation and retaining control; resilience research does not explicitly address openness; technological sovereignty research considers closure at state or corporate level. None of the reviewed approaches explains how external constraints partition ecosystems into layers with differing permissible openness. The study identifies patterns linking regulatory requirements to permissible layer openness and their implications for resilience and digital strategy. The literature was compared across four dimensions; Russian Presidential Decree No. 166 and Government Resolution No. 1912, including annexes, were analysed using six codes. Requirements apply to significant infrastructure facilities rather than organisations and impose thresholds with deadlines: a ban on foreign software use from 1 January 2025 and a 100% share of trusted hardware–software systems by 31 December 2029. Embedded approval and exemption procedures make the boundary permeable, while core compliance assumes sufficient supplies of trusted products from outer layers. Threshold-based measures capture the core’s state, not the ecosystem’s reconfiguration capabilities. Digital strategy should therefore specify capability indicators for layers outside the regulatory perimeter rather than extend the core’s threshold logic to them. The practical contribution lies in distinguishing the orchestrator’s roles as a regulatory administrator and an ecosystem organiser. Conclusions are limited to publicly available legal texts; sectoral transition plans classified as restricted-distribution documents were not examined.