There are a lot of conversations happening right now about cyber resilience. Most focus on technology: Detection speed. Recovery architecture. AI-enabled security operations.
All of those things matter. But after sitting down with Dr. Erika Voss, SVP, Global Chief Security & Data Officer at Blue Yonder, and Sam Archey, VP of Trust at Blue Yonder, I kept coming back to something much more fundamental: Trust.
Not trust as a slogan or marketing message, but trust as something operational. Something built deliberately over time and tested in the moments when organizations are under the most pressure.
That distinction can matter because resilience today isn’t just about recovering systems. It’s also about how organizations communicate, how they lead, and how they maintain confidence while uncertainty is still unfolding.
And for a company like Blue Yonder – operating at the center of global supply chains – that challenge becomes even more visible.
Watch the gesamte Folge.

Das Wichtigste auf einen Blick: Was modernes Cyber-Vertrauen tatsächlich erfordert

• Trust is built through consistency, not perfection. Customers don’t typically expect immediate answers, but they do expect transparency and follow-through.
• Resilienz ist eine praktische Angelegenheit, keine theoretische. Kommunikation, Koordination und Entscheidungsprozesse können genauso wichtig sein wie technische Kontrollmaßnahmen.
• Starke Beziehungen, die bereits vor einem Vorfall aufgebaut wurden, können darüber entscheiden, wie effektiv Teams während eines Vorfalls reagieren.
• Die Widerstandsfähigkeit der Lieferkette kann die Risiken erhöhen, da sich Störungen auf miteinander vernetzte Ökosysteme auswirken.
• Organizations are increasingly judged not on whether incidents happen – but on how they respond when they do.

Resilienz und Vertrauen

One thing became clear very early in this discussion: Erika and Sam don’t think about resilience as a standalone security function. They think about it as a trust function.
Most organizations still separate these ideas:

• Der Sicherheitsdienst kümmert sich um die technischen Maßnahmen.
• Die Abteilung „Kommunikation“ ist für den Nachrichtenverkehr zuständig.
• Die Führung greift ein, wenn eine Eskalation erforderlich ist.

But what Blue Yonder has built is much more integrated than that. Their approach recognizes that customer trust is shaped in real time by operational behavior – not just technical outcomes.
And in a supply chain environment, where countless organizations are interconnected, that operational behavior can become incredibly visible. When something breaks inside that ecosystem, the impact rarely stays isolated. 

Der Moment, in dem das Vertrauen wirklich auf die Probe gestellt wird

One of the strongest themes throughout the conversation was how quickly trust can be lost – and how intentional organizations must be to preserve it.
Erika put it bluntly: Customers are no longer evaluating whether companies experience incidents. That’s become table stakes in the modern threat landscape. What they are evaluating is something much more specific: Did they hear it from you first?

That distinction changes how organizations should think about incident response.
For years, the instinct during cyber events was often to hold communication until every detail was verified. But the reality today is that silence can create uncertainty faster than almost anything else.
Customers don’t typically expect complete answers in the first hour. They want acknowledgment. They want presence. They want to know that someone is actively working on the problem and willing to communicate transparently while things are still unfolding.
That’s where operational trust is built. And according to Erika and Sam, those first 60 minutes can matter more than most organizations realize.

Vorschau: Vertrauen ist in einer Krise entscheidend

In this moment from the STRIVE conversation, we discuss how the first 60 minutes of response can determine customer confidence, reduce propagation delays, and shape long-term business relationships.

Vertrauen aufbauen, bevor man es braucht

The trust Blue Yonder has built with customers wasn’t created during a single crisis. It was built through repeated interactions over time – through transparency, responsiveness, and operational discipline long before pressure entered the equation.
The same applies internally.
One thing both Erika and Sam emphasize is the importance of relationships between teams before incidents occur. Security, communications, engineering, operations, and leadership need to know how to work together ahead of time. Otherwise, the first real test of collaboration happens during a crisis, which can be the worst possible moment to establish operational alignment.
That’s why they spend so much time focusing on process maturity, stakeholder engagement, and tabletop exercises.
Not because those activities are theoretical. Because they create familiarity.
And familiarity helps reduce friction when pressure rises. 

Warum Tabletop-Übungen wichtiger sind, als die meisten Organisationen glauben

There was a particularly practical section of the conversation around tabletop exercises that I think a lot of organizations need to hear.
Too often, tabletops become compliance activities. Something organizations run once or twice a year to satisfy requirements and move on from. But the way Blue Yonder approaches them is much more operational.
For them, tabletops are rehearsals for coordination.

• Wer trifft die Entscheidungen?
• Wie läuft eine Eskalation ab?
• Welche externen Partner müssen einbezogen werden?
• Wie wirken die Bereiche Recht, Kommunikation und Technik zusammen?

Those questions become incredibly important during live incidents. And if teams haven’t worked through them ahead of time, response can slow down immediately.
Sam described how teams begin to understand what it may actually feel like to be pulled into an incident under pressure. That experience matters because it helps build muscle memory – not just for technical teams, but for leadership and operational stakeholders as well.
The organizations that recover most effectively are rarely improvising everything in real time. They’ve practiced.

Die menschliche Seite der Resilienz

What I appreciated most about this conversation was how grounded it was in the human reality of resilience work.
Cyber resilience often gets framed entirely through technology. But people often still determine outcomes.

• Wie Führungskräfte kommunizieren.
• Wie Teams zusammenarbeiten.
• Wie sich Organisationen verhalten, wenn Informationen unvollständig sind.

Those factors help shape customer trust just as much as recovery timelines or technical controls do.
And perhaps the most important lesson from Erika and Sam is that trust isn’t earned during easy moments. It’s earned during uncertainty. During ambiguity. During the moments when organizations have to choose transparency over silence and consistency over perfection.

Die ganze Folge ansehen

In this discussion, you’ll discover:

• Wie Blue Yonder das Vertrauen der Kunden in die Praxis umsetzt.
• Warum Beständigkeit wichtiger sein kann als sofortige Perfektion.
• Die Rolle der Kommunikation bei Cybervorfällen.
• Wie Simulationsübungen die Widerstandsfähigkeit stärken.
• Warum sich die Rahmenbedingungen für die Cyber-Wiederherstellung in Lieferkettenumgebungen ändern können.

Watch now.

FAQs

Q: Why is trust so important in cyber resilience?

A: Because customers increasingly evaluate organizations based on how they respond during incidents, not simply whether incidents occur.

Q: What does “trust as an operating model” mean?

A: It means trust is continuously reinforced through operational behavior, communication consistency, and transparency – not just during crises.

Q: Why do the first 60 minutes of response matter so much?

A: Early communication can shape customer perception, help reduce uncertainty, and help establish credibility during rapidly evolving situations.

Q: How do tabletop exercises improve resilience?

A: They help teams rehearse coordination, escalation, and communication processes before real incidents occur.

Q: What is the biggest lesson from this discussion?

A: That resilience is typically deeply tied to operational trust, and organizations should build that trust before they need it most.

Q: How can organizations help improve customer trust during incidents?

A: By communicating consistently, prioritizing transparency, and building strong internal coordination long before a crisis begins.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

Die wichtigsten Erkenntnisse

• Cyber-Resilienz in MEDITECH-Umgebungen geht über Datensicherung und -wiederherstellung hinaus; ihr Schwerpunkt liegt auf der Aufrechterhaltung der Patientenversorgung und der Betriebskontinuität bei Störungen.
• Einrichtungen des Gesundheitswesens sind einem erheblichen Ransomware-Risiko ausgesetzt, weshalb eine schnelle und zuverlässige Wiederherstellung für den klinischen Betrieb unerlässlich ist.
• Herkömmliche Datenschutzkonzepte tragen den komplexen Abhängigkeiten zwischen klinischen Systemen, Anwendungen und Arbeitsabläufen oft nicht Rechnung.
• Wirksame Wiederherstellungsstrategien müssen die Wiederherstellung miteinander verbundener Systeme koordinieren, um Ausfallzeiten und betriebliche Beeinträchtigungen zu minimieren.
• Commvault’s MEDITECH-focused approach helps combine snapshot-based protection, automated recovery workflows, and recovery visibility to strengthen resilience and preparedness.

When ransomware or operational disruption impacts clinical systems, the effects can ripple quickly across the organization, disrupting workflows, slowing staff productivity, and putting timely care delivery at risk. In these moments, the ability to recover quickly and confidently becomes just as important as preventing the disruption in the first place.

That is why Commvault’s approach to protecting MEDITECH environments is centered on recoverability, resilience, and operational readiness, not just data preservation.

Healthcare remains one of the sectors most heavily targeted by ransomware. In a MEDITECH environment, downtime can interrupt medication workflows, delay access to diagnostic information, and force staff into manual workarounds that increase both risk and complexity. In this context, a strategy that looks good on paper is not enough. Health systems need confidence that recovery will perform under real-world pressure.

That is where Commvault can make a meaningful difference.

Warum herkömmlicher Datenschutz für MEDITECH nicht ausreicht

Viele Organisationen stützen sich nach wie vor auf Datenschutzkonzepte, die für allgemeine IT-Umgebungen entwickelt wurden und nicht den betrieblichen Gegebenheiten im Gesundheitswesen Rechnung tragen. Die Wiederherstellung von MEDITECH erfordert ein Verständnis der Abhängigkeiten zwischen den Anwendungen, der Wiederherstellungsreihenfolge, der Validierungs-Checkpoints sowie der Notwendigkeit, klinische Systeme mit minimalen Unterbrechungen wieder in Betrieb zu nehmen.

Eine erfolgreiche Wiederherstellungsstrategie muss mehr umfassen als nur die Wiederherstellung von Daten. Sie muss die koordinierte Wiederherstellung kritischer Systeme, Anwendungen und Arbeitsabläufe unterstützen, auf die sich medizinisches Fachpersonal täglich verlässt. Commvault hilft Unternehmen dabei, diese Komplexität zu bewältigen – mit einer ausfallsicheren Architektur, optimierten Wiederherstellungsabläufen und einem besseren Überblick über die Wiederherstellungsbereitschaft.

Wie Commvault MEDITECH in der Praxis schützt

Commvault’s approach to MEDITECH protection is designed to align with the operational realities of these environments. Rather than relying on a one-size-fits-all backup model, the solution helps organizations capture application-consistent protection points for critical MEDITECH workloads while helping minimize disruption to production operations.

This architecture provides healthcare organizations with a practical path to faster, more confident recovery. Snapshot-based protection can support rapid restoration for operational resilience, while longer-term backup retention strengthens options for audit, compliance, and broader cyber preparedness. The result is a model that supports both day-to-day recoverability and resilience planning for more severe disruption.

Wie sich Cyber-Resilienz in der Praxis gestalten kann

Wenn Ransomware über Nacht zuschlägt

Stellen Sie sich ein regionales Krankenhaus vor, das über Nacht Opfer einer Verschlüsselungsattacke wird. In einem solchen Szenario kann die Möglichkeit, Daten aus unveränderlichen Sicherungskopien wiederherzustellen und einen strukturierten Wiederherstellungsplan umzusetzen, den Unterschied zwischen einem langwierigen Ausfall und einer kontrollierten Wiederherstellung ausmachen. Commvault unterstützt Unternehmen dabei, dieses Risiko zu minimieren – mit sicheren Wiederherstellungsoptionen, die darauf ausgelegt sind, kritische Systeme schnell und fehlerfrei wieder in Betrieb zu nehmen.

Wenn die Backup-Infrastruktur ins Visier gerät

Angreifer versuchen zunehmend, die Backup-Infrastruktur zu kompromittieren, bevor sie Ransomware einsetzen. Daher ist die Widerstandsfähigkeit der Architektur von entscheidender Bedeutung. Mit unveränderlichem Schutz und isolierten Wiederherstellungsoptionen sorgt Commvault dafür, dass saubere Wiederherstellungspunkte auch dann verfügbar bleiben, wenn Angreifer Zugriff auf Produktionssysteme erlangen.

Wann ein Nachweis der Genesung erforderlich ist

Cyberversicherer, Wirtschaftsprüfer und Compliance-Verantwortliche verlangen zunehmend Nachweise dafür, dass die Wiederherstellungsfähigkeiten getestet, dokumentiert und betrieblich einwandfrei sind. Commvault unterstützt diese Bereitschaft durch Validierungsworkflows, Berichterstellung und Nachweise, mit denen Organisationen im Gesundheitswesen ihre Ausfallsicherheit bereits vor dem Eintreten eines Vorfalls unter Beweis stellen können.

Wie Commvault die Ausfallsicherheit von MEDITECH unterstützt

Commvault unterstützt Unternehmen dabei, MEDITECH-Datenbankvolumes mit anwendungskonsistenten Wiederherstellungspunkten zu schützen und schafft so eine solidere Grundlage für die Wiederherstellung, falls klinische Systeme beeinträchtigt werden.

Wiederherstellung unter Berücksichtigung der MEDITECH-Abhängigkeiten

MEDITECH recovery often involves complex relationships between systems and databases. Commvault’s approach helps support coordinated protection of critical workloads and a recovery model designed to help bring systems back online in the appropriate sequence.

Validierte Wiederherstellung mit flexibler Aufbewahrung

Durch die Kombination von Optionen für eine schnelle Wiederherstellung mit einer längerfristigen Aufbewahrung von Backups unterstützt Commvault Teams im Gesundheitswesen dabei, ihre Ausfallsicherheit über das anfängliche Snapshot-Fenster hinaus zu stärken und eine umfassendere Strategie für Wiederherstellungstests, Validierung und Notfallvorsorge zu entwickeln.

Besserer Einblick in die Wiederherstellungsbereitschaft

Eine solide MEDITECH-Resilienzstrategie hängt von operativer Klarheit ab. Commvault unterstützt Teams dabei, Schutz-Workflows zu zentralisieren, den Überblick über die Wiederherstellungsbereitschaft zu verbessern und die Verwaltung kritischer Datensicherungsaufgaben zu vereinfachen.

Einhaltung gesetzlicher Vorschriften und Versicherungsbereitschaft

Von dokumentierten Wiederherstellungsabläufen bis hin zu Aufbewahrungsstrategien, die bei Audits und Compliance-Gesprächen helfen – Commvault unterstützt Organisationen im Gesundheitswesen dabei, ihre Compliance-Dokumentation zu verbessern und eine ausgereiftere Resilienz zu demonstrieren.

Warum die Umsetzung wichtig ist

Eine erfolgreiche Ausfallsicherheit in einer MEDITECH-Umgebung hängt nicht nur von der Auswahl der richtigen platform ab. Sie erfordert auch die Einhaltung validierter Bereitstellungsanforderungen, Infrastrukturkompatibilität und ein Sicherheitskonzept, das der tatsächlichen Funktionsweise von MEDITECH-Systemen in der Praxis Rechnung trägt. Für Organisationen im Gesundheitswesen kann diese Disziplin bei der Umsetzung genauso wichtig sein wie die Wiederherstellungstechnologie selbst. Eine gut durchdachte Resilienzstrategie trägt dazu bei, dass Teams Wiederherstellungsprozesse wie erwartet durchführen können, wenn sie am dringendsten benötigt werden.

Warum gerade jetzt?

Ransomware-Bedrohungen entwickeln sich ständig weiter, und Angreifer nehmen zunehmend die Backup-Infrastruktur ins Visier, bevor sie die Verschlüsselung einsetzen. Gleichzeitig verlangen Cyberversicherer und Compliance-Verantwortliche Nachweise für getestete Wiederherstellungsfähigkeiten und nicht nur für installierte Tools. Für Gesundheitsorganisationen, die MEDITECH einsetzen, ist es dringender denn je, bereits vor dem Eintreten eines Vorfalls Resilienz aufzubauen. Wenn Organisationen heute in die Wiederherstellungsbereitschaft investieren, können sie ihren Betrieb besser schützen, die Wiederherstellung beschleunigen und die Auswirkungen von Störungen in entscheidenden Momenten minimieren.

Im Gesundheitswesen hängt die Bereitschaft zur Wiederherstellung letztlich vom Vertrauen ab: vom Vertrauen darauf, dass kritische Daten geschützt sind, vom Vertrauen darauf, dass Systeme in der richtigen Reihenfolge wiederhergestellt werden können, und vom Vertrauen darauf, dass die Ausfallsicherheit bereits vor dem Eintreten einer Krise getestet wurde. Das ist der Standard, den Commvault Unternehmen in MEDITECH-Umgebungen hilft zu erreichen, und die Grundlage für einen stärkeren, selbstbewussteren Ansatz im Hinblick auf Cyber-Resilienz.

Unternehmen können diese Grundlage weiter stärken, indem sie mit einem auf das Gesundheitswesen spezialisierten Commvault Managed Service Provider zusammenarbeiten. Neben der Technologie selbst erhalten die Teams im Gesundheitswesen Zugang zu Fachwissen, das ihnen dabei helfen kann, Schutzstrategien an die MEDITECH-Anforderungen anzupassen, die Implementierung sicherer zu gestalten und die laufende Betriebsbereitschaft zu verbessern. Für Organisationen im Gesundheitswesen, die sich mit der Komplexität von MEDITECH auseinandersetzen, kann diese Kombination aus ausfallsicherer Technologie und auf das Gesundheitswesen spezialisiertem Fachwissen dazu beitragen, die Vorbereitungen zu beschleunigen und die Ergebnisse bei der Wiederherstellung zu verbessern – gerade dann, wenn es darauf ankommt.

Abschließende Gedanken

Bei der Wiederherstellung in einer MEDITECH-Umgebung geht es um mehr als nur die Wiederinbetriebnahme der Systeme. Es geht darum, die klinischen Arbeitsabläufe wiederherzustellen, auf die sich das Pflegepersonal bei der Patientenversorgung verlässt. Da sich Ransomware-Bedrohungen ständig weiterentwickeln und Organisationen im Gesundheitswesen unter zunehmendem Druck stehen, operative Resilienz unter Beweis zu stellen, darf die Readiness nicht länger als reine Compliance-Maßnahme oder bloße Backup-Strategie betrachtet werden. Organisationen, die Wiederherstellbarkeit, Validierung und Cyber-Resilienz priorisieren, bevor ein Vorfall eintritt, sind besser aufgestellt, um Störungen zu minimieren, die Patientenversorgung zu schützen und im entscheidenden Moment sicher wieder den Betrieb aufzunehmen. Erfahren Sie, wie Commvault Organisationen im Gesundheitswesen dabei unterstützt, die Ausfallsicherheit von MEDITECH zu stärken, die Wiederherstellung zu beschleunigen und mehr Vertrauen in ihre Fähigkeit zu schaffen, Cyberangriffe abzuwehren. Weitere Informationen finden Sie auf unsererMEDITECH-Dokumentationsseite.

FAQs

Q: Why is cyber resilience especially important for MEDITECH environments?

A: MEDITECH environments support critical clinical and operational workflows that directly impact patient care. Cyber resilience helps healthcare organizations recover quickly from disruptions while maintaining essential services and minimizing care delivery interruptions.

Q: How does cyber resilience differ from traditional backup and recovery?

A: Traditional backup and recovery focus primarily on restoring data after an incident. Cyber resilience expands that focus to include operational continuity, rapid recovery, and proactive measures that help reduce the impact of disruptions.

Q: Why are traditional data protection solutions often insufficient for healthcare organizations?

A: Many traditional solutions are designed for general IT environments and may not account for the complex interdependencies between healthcare applications, systems, and workflows. As a result, recovery can be slower and more disruptive.

Q: What challenges do ransomware attacks create for healthcare providers?

A: Ransomware can disrupt access to clinical information, delay care delivery, and increase operational complexity. Healthcare organizations need recovery solutions that enable fast restoration and confidence in recovery outcomes.

Q: How does Commvault support MEDITECH protection and recovery?

A: Commvault’s approach is designed around healthcare operational requirements, providing application-consistent protection, automated recovery processes, and visibility into recovery readiness to help reduce downtime.

Q: What benefits do snapshot-based protection and automated recovery provide?

A: Snapshot-based protection can support faster restoration of critical systems, while automated recovery workflows help streamline recovery efforts. Together, they improve operational resilience and strengthen preparedness for future disruptions.

Chris DiRado is Principal, Product Experience, at Commvault.

When we talk about cyber resilience, the conversation usually centers on technology: tools, platforms, automation. All of that matters. But when something goes wrong, those aren’t the things that determine how well an organization responds.

People are.

In this episode of STRIVE, I sat down with Dr. Jessica Barker, co-CEO of Cygenta and a leading expert on the human and psychological aspects of cybersecurity. I asked her to discuss a part of resilience that doesn’t always get enough attention – the human side.

What happens when pressure rises, when decisions have to be made quickly, and when teams are forced to work together in ways they may not be used to?

Watch the gesamte Folgean, um zu erfahren, was sie zu sagen hatte.

Das Wichtigste auf einen Blick: Was die menschliche Seite offenbart

• Technology doesn’t fail alone – people and processes are always part of the outcome.
• Selbstvertrauen unter Druck entsteht durch Vorbereitung, nicht durch Instinkt.
• Eine klare Zuständigkeit für Entscheidungen trägt dazu bei, das Zögern bei Vorfällen zu verringern.
• Vertrauen zwischen den Teams trägt dazu bei, die Reaktion und die Wiederherstellung zu beschleunigen.
• Culture plays a measurable role in resilience – it’s not just tools or architecture.

Wenn der Plan auf die Realität trifft

Every organization has a plan. It’s documented, reviewed, and often approved at the highest levels. But the real test isn’t how that plan reads – it’s how it holds up when people are under pressure.

Because that’s when things change. Decisions don’t always follow the script. Communication isn’t always clean. Priorities shift in real time. And in those moments, resilience becomes less about process and more about behavior.

Vorschau: Cyber-Resilienz als kulturelle Norm

In this moment from the episode, Dr. Barker highlights the importance of aligning cybersecurity with organizational values. Rather than positioning security as a blocker, resilient organizations embed it into culture – as an enabler of productivity, positivity, and business growth.

Die Rolle des Selbstvertrauens

One of the most consistent themes in this conversation is confidence. Not confidence in the tools – confidence in the people using them.

Teams that perform well during incidents aren’t guessing. They’ve seen similar scenarios before. They’ve practiced. They understand how to respond, even when conditions aren’t ideal.

That confidence shows up in small ways with potentially faster decisions, clearer communication, and less second-guessing. And over time, those small differences can add up to a significantly stronger response. 

Entscheidungsfindung unter Druck

When something goes wrong, speed matters – but clarity matters more.

• Wer darf Entscheidungen treffen?
• Welche Befugnisse haben sie?
• Wann sollten sie die Angelegenheit an eine höhere Instanz weiterleiten?

If those answers aren’t clear, teams hesitate. And hesitation creates gaps. One of the most important parts of resilience isn’t just defining processes – it’s defining decision ownership. When people know where they stand, they tend to act faster and with more confidence.

Vertrauen ist der Multiplikator

Technology can help enable better and faster responses, but trust can accelerate them. In most organizations, teams operate in their own lanes. Security focuses on threats, infrastructure focuses on systems, and operations focuses on recovery.

That separation works – until an incident forces everyone together. That’s where trust becomes critical. Teams that trust each other:

• Informationen freizügiger weitergeben.
• Arbeiten Sie effektiver zusammen.
• Konzentrieren Sie sich auf die Ergebnisse statt auf die Zuständigkeit.

Ohne dieses Vertrauen können selbst gut durchdachte Prozesse ins Stocken geraten.

Warum Vorbereitung nach wie vor wichtig ist

It’s easy to assume that strong individuals can carry a response. But even experienced teams rely on preparation, such as tabletop exercises, simulations, cross-team drills, and so on. They’re what build the muscle memory that teams rely on when real incidents occur. Without that preparation, even the most capable teams are forced to improvise.

Die ganze Folge ansehen

In dieser Folge von STRIVE beschäftigen wir uns mit folgenden Themen:

• Wie menschliches Verhalten die Reaktion auf Vorfälle beeinflusst.
• Warum klare Entscheidungen unter Druck wichtig sind.
• Was unterscheidet selbstbewusste Teams von reaktiven?
• Wie Kultur die Ergebnisse der Genesung beeinflusst.
• Worauf sich Organisationen konzentrieren sollten, um ihre Widerstandsfähigkeit zu stärken.

Jetzt anschauen.

If you’re thinking about resilience beyond technology, this is a conversation worth your time.

FAQs

Q: Why is the human side of resilience important?

A: Because technology alone doesn’t determine outcomes – people do. Their decisions, communications, and executions under pressure are the keys to success.

Q: What role does preparation play in resilience?

A: Preparation helps build confidence and muscle memory, allowing teams to respond more effectively in real scenarios.

Q: How does trust impact incident response?

A: Trust helps enable faster collaboration, clearer communication, and more efficient decision-making across teams.

Q: Why is decision ownership critical?

A: Without clear ownership, teams hesitate, which can slow response and increase risk.

Q: Can strong tools compensate for weak processes?

A: No. Tools support resilience, but without strong processes and alignment, they can’t deliver effective outcomes.

Q: Where should organizations start improving?

A: Focus on cross-team alignment, clear decision-making structures, and regular scenario-based testing.

Darren Thomsonis Vice President and Chief Technology Officer, EMEA, at Commvault.

For years, recovery planning followed a familiar pattern. Build the plan, document the steps, and assume it will work when needed. For a long time, that approach held up. Hardware failures, isolated outages, even natural disasters – these were scenarios organizations could anticipate and plan for with some level of confidence.
But the equation has changed.
In this episode of STRIVE, I sat down with Commvault’s Jason Cray, Principal Product Experience, to explore a reality we continue to see across organizations of all sizes: Most don’t fail because they lack a recovery plan. They fail because they’ve never proven that plan will hold up under real pressure.
Watch the gesamte Folge.

Die wichtigsten Erkenntnisse: Warum Sanierungspläne scheitern

• A documented plan isn’t the same as a proven one. If it hasn’t been tested in realistic conditions, it’s still an assumption.
• Recovery is a team sport. Security, infrastructure, and operations must align – or recovery slows down.
• Most investment still happens “left of boom.” Prevention matters, but recovery readiness often gets overlooked.
• Tests decken Schwachstellen auf und stärken das Vertrauen. Ohne sie verlassen sich Unternehmen nur auf Hoffnung.
• Resilienz ist eine operative Disziplin. Sie erfordert iteratives Vorgehen, Kommunikation und kontinuierliche Verbesserung.

The Problem With ‘It Should Work’

On paper, recovery looks straightforward. You define when to recover to, what needs to come back, and where it should be restored. The process appears logical, structured, and manageable.
But as Jason points out, that simplicity rarely survives real-world conditions.
Plans are written in controlled environments, but they’re executed in chaos. When an incident hits, teams aren’t calmly stepping through documentation – they’re reacting, troubleshooting, and trying to align in real time. That’s where the gap emerges. Not between tools and technology, but between expectation and execution.

Ein kleiner Einblick: Warum Pläne unter Druck scheitern

In this moment from the conversation, Jason and I break down why having a plan isn’t enough – and what it actually takes to know a plan will work when it matters.

We’ve Seen This Before

What’s interesting is that this isn’t a new problem; it’s a familiar one, just in a different context.
If you go back to the early days of disaster recovery, organizations followed a similar pattern. Plans existed, but testing was inconsistent at best. Jason shared an example of spending an entire night helping a client pass a disaster recovery test they thought they were ready for. The plan looked solid. The execution told a different story.
Over time, organizations adapted. They tested more frequently, introduced failover exercises and, in some cases even ran production from secondary environments to prove readiness. That shift from assumption to validation is exactly what Cyber-Resilienz now requires.

Die erste Störung: Kommunikation

If there’s one issue that consistently surfaces, it’s communication.
In many organizations, responsibilities are clearly defined – security handles prevention, infrastructure manages systems, and operations owns recovery. Individually, each team may be doing exactly what they’re supposed to do.
But recovery doesn’t happen in isolation. It depends on how well those teams work together when something goes wrong.
As Jason describes, too often it becomes a handoff model: “We’ve done our part, now it’s someone else’s turn.” That approach introduces delays, confusion, and ultimately risk. During a cyber event, coordination matters more than ownership.

The ‘Left of Boom’ Problem

Another pattern we continue to see is the imbalance in where organizations focus their efforts.
There’s significant investment in prevention – security tools, detection platforms, and defensive strategies designed to stop an attack before it happens. That investment is necessary, and it plays a critical role.
But far less attention is given to what happens after the event.
The assumption is that if enough effort is spent on prevention, recovery becomes a secondary concern. In reality, the opposite is true. At some point, something gets through. And when it does, recovery becomes the defining factor in how an organization responds.

Von der Hoffnung zur Evidenz

This is where the mindset needs to shift.
It’s not about adding more tools or rewriting documentation. It’s about moving from a model based on hope to one grounded in evidence.
Jason highlights a key observation: The organizations that handle disruption well aren’t the ones that avoid incidents – they’re the ones that experience less impact when those incidents occur. They’ve tested their processes. They’ve validated their assumptions. They understand where their gaps are.
Most importantly, they’ve built confidence – not by believing the plan will work, but by proving it.

Fang klein an, baue Schwung auf

For many teams, the challenge isn’t understanding the problem – it’s knowing where to begin.
The answer isn’t to overhaul everything at once. It’s to start small and build from there.
Focus on one or two critical services. Understand what’s required to recover them. Bring together the teams responsible for those systems and test the process end-to-end. From there, expand the scope and continue refining.
This approach does more than improve recovery – it builds alignment, reinforces communication, and creates the foundation for broader resilience.

Die Realität: Kein Plan übersteht den ersten Kontakt

One of the most honest moments in our discussion was this: Even the best plan won’t work exactly as written.
That’s not a failure – it’s expected.
Jason puts it simply: If you don’t have a plan, you will fail. But even if you do have one, it won’t unfold perfectly in the moment.
What matters is how prepared to adapt your teams are. Testing creates that adaptability. It builds the muscle memory needed to respond effectively when conditions don’t match expectations.

Die ganze Folge ansehen

There’s much more we cover in this STRIVE conversation, including:

• Warum Wiederherstellungspläne oft scheitern, obwohl sie gut dokumentiert sind.
• Was zeichnet Organisationen aus, die sich effektiv erholen?
• Wie sich Kommunikationslücken auf die Umsetzung auswirken.
• Wo soll man bei der Verbesserung der Wiederherstellungsbereitschaft ansetzen?
• Warum das Testen die Grundlage für Resilienz ist.

Jetzt anschauen.
If you’ve ever questioned whether your recovery plan would actually work, this is a conversation worth your time.

FAQs

Q: Why isn’t having a recovery plan enough?

A: Because most plans are never validated under real-world conditions. Without testing, they remain assumptions rather than proven strategies.

Q: What causes recovery plans to fail?

A: The most common issues in recovery plans are lack of testing, poor cross-team communication, and gaps between documented processes and real execution.

Q: What does “left of boom” mean?

A: Left of boom refers to the focus on preventing incidents before they occur. Many organizations invest heavily here but underinvest in recovery capabilities.

Q: How often should recovery plans be tested?

A: Recovery plans should be tested regularly and under varied conditions. Testing should simulate realistic scenarios, not just controlled exercises.

Q: Where should organizations start?

A: Start with a small set of critical services, align the responsible teams, and test recovery end-to-end before expanding.

Q: What is the key mindset shift?

A: Moving from hope-based planning to evidence-based validation.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

We’ve spent years focusing on identity security in the context of people – who have access, what they can do, and how to control it. That model made sense when most activity in the environment was driven by human users.But that’s no longer the case.Machine identities – applications, services, APIs, and automated workloads – now play a central role in how modern systems operate. They authenticate, communicate, and execute tasks, often without direct oversight. And in many environments, they already outnumber human identities by a wide margin.In this episode of STRIVE, I sit down with Dan Conrad, Principal Technologist and a fellow Field CTO at Commvault. We take a closer look at what that shift means – not just from a security perspective, but also from a governance standpoint. And we explore why so many organizations are still treating this as a secondary concern.Watch the gesamte Folge.

Das Wichtigste auf einen Blick: Wohin sich das Risiko verlagert

• Die Zahl der Maschinenidentitäten wächst schneller als die der menschlichen Identitäten, oft um ganze Größenordnungen.
• Governance models haven’t kept pace, creating blind spots in access and control.
• Visibility is the core challenge. Many teams don’t fully understand how machine identities behave.
• Die Ausweitung von Zugriffsrechten geht über die Benutzer hinaus, da Maschinenidentitäten häufig über dauerhaften Zugriff verfügen.
• Resilienz hängt davon ab, dass man den Aufgabenbereich dieser Maschinenidentitäten versteht und steuert, bevor sie zu einem Problem werden.

Das Identitätsmodell hat sich verändert

For a long time, identity management was relatively straightforward. You could map users to roles, define access policies, and build controls around predictable behavior. Even with complexity, the model was still anchored in human activity.Machine identities have broken that model.They’re created dynamically, often as part of development or deployment processes. They interact across systems in ways that aren’t always visible or well-documented or audited. And unlike human users, they don’t follow a clean lifecycle – they aren’t onboarded and offboarded in the same structured way.That creates a different kind of challenge. It’s not just about controlling access anymore. It’s about understanding how that access is being used, how it evolves, and how it connects across the environment.

Sneak Peek: You Can’t Phish a Non-Human Identity

In this moment from the STRIVE discussion, Dan describes how attackers aren’t targeting nicht-menschliche Identitäten directly through phishing – they’re malicious actors using compromised human accounts through social engineering, as a steppingstone to escalate privileges and impersonate powerful machine identities. Once inside, techniques like pass-the-hash and overprivileged service accounts allow attackers to move laterally and vertically, even after passwords are reset.

Die Governance-Lücke

The real issue isn’t that machine identities exist , it’s how they’re governed.In most organizations, there’s a clear process for managing human access:

• Die Anträge werden genehmigt.
• Die Berechtigungen werden überprüft.
• Änderungen werden nachverfolgt.

There’s a level of discipline that comes from years of focus on user identity. However, machine identities often fall outside of that structure. They’re created quickly to support applications or automation. They’re granted the permissions needed to function, sometimes more than necessary. And over time, those permissions persist. These overprovisioned accesses are rarely audited, reviewed, and more importantly rarely reduced.That’s where the gap forms.It becomes difficult to answer basic questions about access. Not because the information doesn’t exist, but because it hasn’t been organized or managed in a way that makes it usable.

Transparenz vor Kontrolle

When organizations start to address this problem, the instinct is often to tighten controls.

• Berechtigungen einschränken
• Zugriff einschränken
• Neue Richtlinien anwenden

But control without visibility doesn’t solve much.If you don’t understand how identities are being used, the business context of it in terms of  where they connect, what they interact with, and how they move across systems, then any attempt to restrict them becomes reactive and could result in slowing down business operations.That’s why visibility needs to come first.Once you can see how machine identities behave, patterns start to emerge. You can begin to understand where access is excessive, where dependencies exist, and where risk is concentrated. From there, governance can become more precise and more effective.

Ein etwas anderes Privilegienproblem

Privilege sprawl isn’t new. Most organizations have spent years trying to manage excessive access among human users.Machine identities introduce a similar issue, but with a different dynamic. Their access is often embedded into systems. It’s persistent, automated, and rarely questioned once it’s in place. That makes it harder to detect and easier to overlook.And when something goes wrong, those identities can become a pathway for malicious actors to exploit

Wo soll man anfangen?

For most organizations, the challenge isn’t awareness, it’s knowing where to start.The first step isn’t a major transformation. It’s building clarity. Understanding how many machine identities exist. Where they’re being created. What permissions they have. How they’re used. And most importantly, confirming that a human user is mapped to a collection of nicht-menschliche Identitäten for the purposes of auditability and accountability.Those questions sound simple, but they’re often difficult to answer. And that’s exactly why they matter. Because once you can answer them, you’re no longer operating in the dark.

Die ganze Folge ansehen

In this installment of STRIVE, we go deeper into how machine identities are changing the way organizations should think about access, governance, and resilience. It’s a practical conversation about what’s happening now – and what needs to change moving forward.Jetzt anschauen.

Ressource

If you’re interested in learning more about this topic, check out this e-book on nicht-menschliche Identitäten.

FAQs

Q: What is a machine identity?

A: A machine identity is a non-human identity used by applications, services, or systems to authenticate and interact with other resources.

Q: Why are machine identities becoming a bigger risk?

A: Because they are increasing in number, often have persistent access, and are not always governed as strictly as human users.

Q: How are they different from user identities?

A: They operate continuously, are embedded in automated workflows, and often lack structured lifecycle management.

Q: What is the biggest challenge organizations face in governing nicht-menschliche Identitäten?

A: Visibility. Many teams don’t have a clear understanding of how many machine identities are created, used, or interconnected.

Q: How does this impact resilience?

A: If compromised, machine identities can enable a malicious actor’s rapid movement across systems, making incidents harder to contain and recover from.

Q: Where should organizations start?

A: By identifying machine identities, understanding their permissions, and building governance practices that match their scale and complexity. And most importantly, confirming that a human user is mapped to a collection of nicht-menschliche Identitäten for the purposes of auditability and accountability

Vidya Shankaran is Field CTO at Commvault.

Jahrzehntelang lag der Schwerpunkt im IT-Betrieb auf der Verfügbarkeit:

• Sorgen Sie dafür, dass die Infrastruktur weiterläuft.
• Erreichen Sie Ihr Wiederherstellungszeitziel (RTO).
• Erfüllen Sie Ihr Wiederherstellungsziel (RPO).

But modern cyber threats don’t respect infrastructure boundaries – and recovery isn’t just about restoring systems anymore. It’s about restoring clean, trusted data – across teams, under pressure.
In this episode of STRIVE, I sat down with Stephen Foskett, founder and president of the Futurum Group’s Tech Field Day, to discuss an emerging discipline: resilience operations – or ResOps.

And it’s more than a buzzword. It’s a shift in how organizations think about recovery intelligence.
Watch the gesamte Folge.

Das Wichtigste auf einen Blick: Was sich bei ResOps ändert

• ResOps moves recovery from infrastructure-focused to business-focused. It’s not just about bringing systems back online – it’s about restoring trusted, usable data.
• Traditional RTO and RPO metrics aren’t enough anymore. Die „Mean Time to Clean Recovery“(MTCR) entwickelt sich zu einer aussagekräftigeren Methode zur Messung der Ausfallsicherheit.
• Breaking down silos is foundational to cyber readiness. Security, infrastructure, and DevOps must operate in sync – not in parallel.
• Resilience is an operational discipline, not a tool. Culture, communication, and coordination matter as much as technology.
• Recovery intelligence is becoming a competitive differentiator. Organizations that recover cleanly and quickly protect revenue, reputation, and trust. 

From IT Ops to ResOps: What’s Changed?

Stephen blickt auf eine frühere Ära der IT zurück, in der Teams häufig Systeme betreuten, ohne die damit verbundenen Geschäftsanwendungen vollständig zu verstehen. Unter „Wiederherstellung“ verstand man damals die Wiederherstellung der Infrastruktur. Heute reicht dieses Modell nicht mehr aus. Moderne Umgebungen zeichnen sich durch folgende Merkmale aus:

• Verteilt
• Cloud
• DevOps-orientiert
• Sicherheitsrelevant
• Eng mit den Einnahmequellen verzahnt

ResOps acknowledges that recovery is no longer an isolated IT function. It’s a cross-functional discipline that helps connect infrastructure, software development, and security with real business outcomes.

Why Traditional Metrics Don’t Tell the Whole Story

RTO. RPO. These metrics have guided disaster recovery planning for years. But as Stephen explains, restoring quickly isn’t enough if the data you restore isn’t clean.
Enter a more meaningful metric: MTCR. It’s not just how fast you recover; it’s how fast you can recover to a verified, trusted state.
In a ransomware event, that difference matters enormously. Restoring compromised data can restart an attack cycle. ResOps focuses on restoring operational integrity – not just functionality.

Vorschau: Warum eine „Clean Recovery“ wichtig ist

In this moment from STRIVE, Stephen explains why traditional recovery metrics miss the mark – and why recovery is a cross-functional discipline.

Das eigentliche Hindernis: Organisatorische Silos

Technology isn’t usually the biggest blocker to resilience. Structure is. Security teams often report to one executive. Infrastructure teams to another. Application teams to yet another. Each with different priorities, different incentives, and different definitions of success.
ResOps challenges that fragmentation.
Stephen discusses how collaborative workshops and cross-functional alignment are helping break down those silos. Because during a cyber event, organizational misalignment slows recovery more than tooling gaps ever will.

Warum Commvault sich in dieser Diskussion engagiert

STRIVE isn’t about product features. It’s about how recovery thinking is evolving. ResOpsdeckt sich genau mit dem, was wir in der Praxis beobachten:

• Kunden, die bei Vorfällen Schwierigkeiten mit der Koordination haben.
• Unternehmen, die ihre Infrastruktur wiederherstellen, aber die Datenintegrität in Frage stellen.
• Die Unternehmensleitung fordert Kennzahlen, die die tatsächlichen geschäftlichen Auswirkungen widerspiegeln.

The concept of MTCR reframes recovery intelligence around business trust – and that’s where the industry is heading. Recovery is no longer a back-office process. It’s an executive concern.

Die Zukunft der Recovery Intelligence

Looking ahead, ResOps is likely to mature rapidly. Over the next 12–18 months, organizations are expected to:

• Sicherheits- und Wiederherstellungsabläufe enger miteinander verknüpfen.
• Führen Sie neue, auf die Erholung ausgerichtete Kennzahlen ein.
• Resilienz bereits in früheren Phasen des Anwendungslebenszyklus umsetzen.
• Investieren Sie in eine Lösung, die saubere Daten von kompromittierten Daten unterscheidet.

Cyber threats are accelerating. Recovery strategies must evolve at the same pace. ResOps helps provide a framework for doing that.

Die ganze Folge ansehen

In dieser Folge sprechen wir über:

• Wie sich ResOps vom herkömmlichen IT-Betrieb unterscheidet.
• Warum MTCR dazu beiträgt, die Kennzahlen zur wirtschaftlichen Erholung neu zu definieren.
• So sieht organisatorische Ausrichtung in der Praxis aus.
• Wie die DevOps-Kultur die Ausfallsicherheit beeinflusst.
• Wohin sich die Recovery-Intelligence voraussichtlich als Nächstes entwickeln wird.

Jetzt anschauen.
If you’re responsible for cyber readiness, continuity, or recovery strategy, this is a must-watch discussion.

FAQs

Q: What is ResOps?

A: ResOps (Resilience Operations) is an emerging discipline that integrates IT operations, security, DevOps, and business stakeholders to help improve recovery intelligence and organizational resilience.

Q: How is ResOps different from traditional IT operations?

A: Traditional IT ops focuses primarily on infrastructure uptime. ResOps expands that focus to include clean data recovery, cross-functional coordination, and business alignment.

Q: What is Die „Mean Time to Clean Recovery“ (MTCR)?

A: MTCR measures how quickly an organization can restore verified, clean data and resume safe operations after a cyber event – not just how quickly systems are brought back online.

Q: Why are metrics like RTO and RPO insufficient in modern environments?

A: They measure speed and data currency, but not data integrity. In ransomware scenarios, restoring compromised data can extend disruption.

Q: How can organizations start implementing ResOps?

A: Begin by:

• • Abstimmung zwischen Sicherheits-, Infrastruktur- und DevOps-Teams.
  • Bewertung von Wiederherstellungskennzahlen über RTO/RPO hinaus.
  • Testen von sauberen Wiederherstellungsprozessen.
  • Abbau operativer Silos.
  • Das Resilienzdenken bereits in einer früheren Phase der Systemgestaltung einbeziehen.

Q: Why is recovery intelligence becoming more important?

A: As cyber threats grow more sophisticated, the ability to recover cleanly, quickly, and confidently directly impacts revenue, customer trust, and regulatory posture.

Darren Thomsonis a Field CTO at Commvault.

Scaling a data-driven company is hard. Scaling one while meeting GDPR requirements, managing thousands of customers, enabling analytics teams, and standing up new infrastructure in under two weeks? That’s a different level of complexity.
In a recent episode of STRIVE, I sat down with Asif Dromi of monday.com and Ben Herzberg of Commvault to unpack what it really takes to operationalize data security at scale – not in theory, but in practice. This isn’t a high-level conversation about best practices. It’s a real-world look at how security, compliance, automation, and infrastructure decisions intersect when the clock is ticking.
Watch the gesamte Folge.
If you’re a CISO, data leader, architect, or compliance owner, this episode gives you something more valuable than theory. It shows how:

• Ein schnell wachsendes Unternehmen bewältigte die Herausforderungen der DSGVO, ohne dabei die Innovation zu bremsen.
• „Infrastructure as Code“ kann Audits vereinfachen.
• Automatisierung verringert Risiken, anstatt die Komplexität zu erhöhen.
• Security and business agility don’t have to compete.

It’s rare to hear directly from operators who’ve done this under real constraints. That’s what makes this STRIVE conversation different.

Die wichtigsten Erkenntnisse: Umsetzung von Datensicherheit in großem Maßstab

• Compliance and growth don’t have to compete. Monday.com demonstrates how GDPR requirements and rapid expansion can coexist when security is built into architecture from the start.
• Manual permissions don’t scale. Automation does. Infrastructure as code and API-driven access controls can turn governance from a bottleneck into a force multiplier.
• Role-based access must evolve with data usage. As more teams depend on analytics, visibility and fine-grained controls become important to help prevent permission sprawl.
• Operationalized security means visibility. It’s not just about setting policies – it’s about monitoring, auditing, and adapting controls dynamically as environments change.
• Speed is possible when architecture is intentional. A compliant European data warehouse stood up in under two weeks because governance, automation, and tooling were designed to scale.
• Security maturity enables innovation. When permissions, infrastructure, and compliance are programmable, organizations can move faster.

Die eigentliche Herausforderung: Wachstum + Compliance + Geschwindigkeit

For monday.com, the challenge wasn’t just storing European data in Europe. It was:

• Gewährleistung der DSGVO-Konformität und der regionalen Datenspeicherung.
• Sicherstellen, dass die Mitarbeiter nur auf relevante Daten zugreifen.
• Gewährleistung von Transparenz und Nachvollziehbarkeit.
• Unterstützung von Analysten und Entwicklern, die schnellen Zugriff benötigten.
• Und das alles unter hohem Zeitdruck.

As Asif explains in the episode, becoming a data-driven organization means internal access expands rapidly. The more teams rely on analytics, the more complex permissions become.
And that’s where many organizations hit a wall. Security becomes manual, permissions become fragile, and compliance becomes reactive. That’s not operationalized security. That’s a house of cards.

Designing Security into the Architecture from Day One 

Einer der spannendsten Aspekte dieser Folge ist, wie monday.com das Problem aus architektonischer Sicht angegangen ist. Anstatt die Compliance nachträglich einzubauen, hat das Unternehmen Folgendes entwickelt:

• Ein eigens dafür vorgesehenes europäisches Data Warehouse.
• Klare, rollenbasierte Zugriffskontrollen.
• Feinkörnige Berechtigungsmodelle.
• Automatisierte Governance-Ebenen.

Ben beschreibt, was in vielen großen Unternehmen geschieht: Im Laufe der Zeit häufen sich Berechtigungen in mehreren Schichten an, oft ohne zentrale Übersicht. Schließlich weiß niemand mehr genau, wer auf welche Daten zugreifen darf. Sicherheit zu operationalisieren bedeutet, diese Fehlentwicklung zu vermeiden. Es bedeutet, Systeme zu entwickeln, bei denen sich die Governance automatisch mit steigender Nutzung skaliert.

Automatisierung ist der Kraftmultiplikator

If there’s one theme that runs through this episode, it’s automation. Instead of treating permissions as tickets and manual updates, monday.com wrapped their infrastructure in code. Databases, roles, and access policies could be created and modified programmatically.
The result? A compliant, scalable environment stood up in less than two weeks. That’s not luck. That’s architecture. And it’s a powerful reminder that security doesn’t slow you down when it’s built correctly. It enables speed.

Was die Umsetzung von Datensicherheit wirklich bedeutet

“Operationalizing” gets used a lot. In this episode, it’s defined as:

• Kontinuierliche Transparenz bei sensiblen Daten.
• Zentralisierte und automatisierte Berechtigungsverwaltung.
• Zugriffsüberwachung.
• Integration mit Tools für die Zusammenarbeit.
• Richtlinien, die sich an die steigende Nutzer- und Datenmenge anpassen.

Static controls don’t scale. Manual workflows don’t scale. Security must become dynamic – part of the operating fabric of the organization. And that shift is where many enterprises struggle today.

Die komplette Folge von STRIVE ansehen

In the discussion, you’ll hear more about:

• Wie monday.com sein europäisches Data Warehouse aufgebaut hat.
• Die wichtigsten Erkenntnisse aus der raschen Umsetzung.
• Warum Automatisierung unverzichtbar war.
• Was Unternehmen oft unterschätzen, wenn es um die Ausuferung von Berechtigungen geht.
• Wie man die Umsetzung von Governance-Maßnahmen angeht, bevor KI-Initiativen ausgeweitet werden.

Jetzt anschauen.

FAQs 

Q: How can small teams implement scalable data security?

A: Start with a clear permissions model and infrastructure-as-code tools. Automate permission management early to help avoid manual bottlenecks as you grow.

Q: What role does automation play in compliance?

A: Automation helps enable consistency, reduce errors, and simplify audits. Using APIs and scripts, you can monitor and adjust permissions dynamically.

Q: How long does it typically take to set up a compliant, scalable data environment?

A: With the right planning and tools, organizations like monday.com have achieved this in less than two weeks. Speed depends on scope and existing infrastructure.

Q: What are best practices for operationalizing data security?

A: Implement role-based access controls, automate permission management, monitor access logs regularly, and integrate security tools with collaboration platforms for real-time oversight.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

Die wichtigsten Erkenntnisse

• Compliance-Rahmenwerke halten die aus tatsächlichen Fehlschlägen gewonnenen Erkenntnisse fest und helfen Organisationen dabei, ihre Widerstandsfähigkeit, Governance und operative Stabilität zu stärken.
• Unternehmen, die Compliance als Maßnahme zum Aufbau von Vertrauen betrachten, können dazu beitragen, das Vertrauen der Kunden, die Beziehungen zu Partnern und die Glaubwürdigkeit der Marke zu stärken.
• Die Angleichung der regulatorischen Rahmenbedingungen und strenge Risikokontrollen können dazu beitragen, die Versicherungsergebnisse zu verbessern, indem sie eine ausgereifte und widerstandsfähige Sicherheitslage demonstrieren.
• Durch die Verknüpfung von Compliance-Anforderungen mit messbaren Geschäftsergebnissen können Unternehmen ihre Investitionen in die Widerstandsfähigkeit direkt mit dem Schutz ihrer Einnahmen und der Geschäftskontinuität in Verbindung bringen.
• Maßnahmen zur Stärkung der Cyber-Resilienz wie unveränderliche Backups, schnelle Wiederherstellung und Governance-Rahmenwerke helfen Unternehmen dabei, Compliance in einen Wettbewerbsvorteil zu verwandeln.

In boardrooms across Europe and beyond, compliance has become a loaded word. It conjures images of endless documentation, mounting regulatory pressure, and the looming threat of fines.
GDPR. NIS2. DORA. The acronyms keep coming, and for many organizations, it can feel like they are choking on regulation.
But what if we’ve been looking at compliance the wrong way? What if compliance isn’t just about avoiding penalties – but about building a better, stronger, more resilient business?

Die Versicherungsanalogie: Regeln, die aus gutem Grund existieren

Thier’s a useful parallel between compliance and insurance.
When you insure your car, the insurer sets certain conditions. Your brakes must work. Your tires shouldn’t be bald. An alarm system might be required. You can argue about the inconvenience, or the cost – but fundamentally, those rules exist because they help reduce risk. They help make accidents less likely. They help protect both you and others.
And hier’s the key point: Those requirements are usually a good idea, whether you buy the insurance or not.
Regulation works in much the same way. Governments and regulators don’t create frameworks because they enjoy it. Regulations are responses to real-world failures – data breaches, operational disruptions, systemic risk. They codify lessons learned the hard way.
You may object to the burden. You may find it frustrating. But when you look closely at what these frameworks require, it’s hard to argue that the core principles are unsound.

• Schützen Sie Kundendaten.
• Sicherstellung der betrieblichen Ausfallsicherheit.
• Machen Sie sich mit den Risiken Ihrer Lieferkette vertraut.
• In der Lage sein, sich von Cybervorfällen zu erholen.
• Zeigen Sie, dass Sie verantwortungsbewusst handeln und Rechenschaft ablegen.

Das ist alles keine schlechte Idee.

Von der Vermeidung von Bußgeldern bis hin zur Schaffung von Vertrauen

Too often, compliance is framed defensively: “Do this so you don’t get fined.” “Do this so you don’t go to jail.”

That’s a low bar. And it’s a missed opportunity. When we shift the perspective, compliance becomes something much more powerful. It becomes a driver of trust.
Take GDPR as an example. At its heart, it’s about protecting personal data. If your organization implements strong data protection practices – not just to tick a box, but because your systems genuinely safeguard customer information – that builds trust. Customers are more confident doing business with you. Partners are more willing to integrate with you. Regulators view you as lower risk.
Trust is not a regulatory outcome. It’s a commercial advantage.
The same applies to the Digital Operational Resilience Act. It’s not just about reporting incidents; it’s about being able to withstand and recover from disruption. In a world whier cyberattacks are inevitable, resilience is not optional. It’s foundational to continuity, reputation, and long-term value.
When compliance drives resilience, resilience drives business stability – and stability drives growth.

Regulierung und Versicherung: Ein Regelkreis

Thier’s also a natural alignment between regulation and insurance markets. When regulators mandate certain standards, insurers quickly follow. Organizations that demonstrate compliance and strong risk controls are more attractive to underwriters. They may benefit from better terms, broader coverage, or more favorable premiums.
This creates a reinforcing cycle:

• Die Verordnung legt Mindeststandards fest.
• Unternehmen verstärken ihre Kontrollmaßnahmen.
• Versichierr belohnen ein stärkeres Risikobewusstsein.
• Die Märkte werden stabiler und widerstandsfähiger.

Compliance ist in diesem Zusammenhang ein Signal an den Markt: Wir nehmen Risiken ernst.

Das fehlende Glied: Die Verknüpfung von Compliance mit Geschäftsergebnissen

One of the most important opportunities for organizations – particularly technology providers – is to make the “line of sight” between compliance and business value explicit.
For example:

• Wenn ein Produkt unveränderliche Sicherungskopien erstellt, trägt dies zur Einhaltung gesetzlicher Anforderungen hinsichtlich der Datenintegrität bei.
• Wenn dies eine schnelle Wiederherstellung nach Cybervorfällen ermöglicht, trägt dies zur Erfüllung der Vorgaben zur operativen Widerstandsfähigkeit bei.
• Wenn es klare Prüfpfade und Berichtsfunktionen bietet, trägt dies zur Erfüllung der Anforderungen an Governance und Aufsicht bei.

But it shouldn’t stop thier. The next step is to articulate the business benefit:

• Immutable backups help reduce the impact of ransomware – and protect revenue.
• Faster recovery helps minimize downtime – and preserves customer confidence.
• Strong governance helps reduce regulatory scrutiny – and enhances brand credibility.

This mapping is critical. Compliance is not the end goal; it’s the mechanism that enables the outcomes that businesses care about: continuity, reputation, customer trust, and competitive differentiation.

Compliance als Innovation, nicht als Verpflichtung

Thier’s a tendency to treat compliance as a “get-it-done” exercise. A cost center. A necessary evil.
But if we look at history, many best practices that are now considered fundamental to modern IT and security originated in regulatory or insurance requirements. Over time, they became embedded in how well-run organizations operate.
Encryption. Access controls. Incident response planning. Business continuity testing. Third-party risk management.
At one time, these may have been viewed as regulatory burdens. Today, they are table stakes for any serious enterprise.
The organizations that treat compliance as an innovation catalyst – rather than a checkbox exercise – are often the ones that pull ahead. They embed resilience into their architecture. They design with governance in mind. They turn regulatory requirements into product capabilities and customer value propositions.

Cyber-Resilienz: Wo Compliance und Strategie aufeinandertreffen

This is whier cyber resilience becomes central.
Modern regulations increasingly recognize a simple truth: Prevention is not enough. Incidents will happen. The differentiator is how well an organization can respond and recover.
Cyber resilience – the ability to withstand, recover from, and adapt to cyber disruption – is no longer just a security concern. It’s a strategic imperative. It supports regulatory compliance, yes. But more importantly, it underpins operational continuity and business confidence.
When organizations invest in resilient architectures, immutable data, rapid recovery capabilities, and robust governance frameworks, they are not merely satisfying regulators. They are building durable enterprises.

Ein anderer Blick auf Compliance

Perhaps it’s time to change the narrative.
Instead of asking, “What’s the minimum we need to do to comply?” we should be asking:

• Inwiefern macht uns diese Verordnung stärker?
• Welche bewährte Praxis wird hier festgeschrieben?
• Wie können wir dies nutzen, um das Vertrauen unserer Kunden und Partner zu stärken?
• Inwiefern verschafft dies einen Wettbewerbsvorteil?

Compliance done well is not about fear. It’s about foresight.
It reflects lessons learned across industries. It embeds best practice into everyday operations. And when connected clearly to product capabilities and business outcomes, it becomes a powerful commercial story.
Yes, regulation can feel burdensome. Yes, the acronyms keep coming. But underneath the paperwork lies something far more valuable: a framework for running a better business.
Compliance isn’t just about avoiding penalties. It’s about enabling resilience. And resilience, ultimately, is what drives sustainable success. Learn more about how Commvault enables data protection to help your organization meet compliance requirements hier.

FAQs

Q: Why should organizations view compliance as more than a regulatory obligation?

A: Compliance frameworks often reflect best practices developed in response to real-world cyber incidents, operational failures, and governance challenges. Organizations that embrace compliance strategically can help strengthen resilience, improve trust, and create long-term business value.

Q: How does compliance contribute to customer trust?

A: Strong compliance practices demonstrate that an organization takes data protection, governance, and operational continuity seriously. This can help increase customer confidence, strengthen partner relationships, and position the organization as a lower-risk business.

Q: What is the connection between compliance and cyber resilience?

A: Modern regulations increasingly focus on an organization’s ability to recover from disruptions rather than solely preventing them. Investments in resilient infrastructure, immutable backups, and rapid recovery capabilities can help organizations maintain continuity during cyber incidents.

Q: How can compliance positively impact insurance and risk management?

A: Organizations with mature compliance programs and strong security controls are often viewed more favorably by insurers. This can lead to better coverage options, improved policy terms, and potentially lower premiums.

Q: Why is it important to connect compliance initiatives to business outcomes?

A: Compliance efforts are most effective when organizations clearly demonstrate how controls support broader goals such as protecting revenue, reducing downtime, and preserving customer trust. This helps leadership view compliance as a strategic investment rather than a cost center.

Q6: How can organizations turn compliance into a competitive advantage?

A: Businesses that embed resilience, governance, and security into their products and operations can differentiate themselves in the market. By proactively aligning with regulatory expectations, organizations can strengthen their reputation and create greater confidence among customers and stakeholders.

Darren Thomson is Field CTO at Commvault.

Die wichtigsten Erkenntnisse

• Bei der operativen Souveränität geht es darum, wer Zugriff auf Systeme hat und unter welcher Rechtshoheit diese betrieben werden.
• Der Zugriff von Anbietern, Telemetrie-Datenströme und Support-Prozesse können zu versteckten Souveränitätslücken führen.
• Die operative Souveränität lässt sich schwerer nachweisen, da sie eine kontinuierliche Überwachung und Prüfung erfordert.
• Unternehmen müssen in der Lage sein, jeden Zugriffsweg in geschützte Umgebungen nachzuweisen und zu dokumentieren.

Ask most organizations where their sovereignty program is strongest, and the answer is usually some version of the same two things: data locality and encryption. They know where their primary data lives. They’ve implemented bring-your-own-key or hold-your-own-key arrangements. They can point to certifications.

Ask them who accessed their sovereign environment in the last ninety days, from which countries, and under which legal jurisdictions – and the confidence tends to evaporate.

Operational sovereignty is the hardest pillar to audit, the most likely to be underestimated, and the most common place where a sovereignty posture that looks solid on paper breaks down in practice. The „„Digital Sovereignty Readiness Report““ names it as one of the four pillars – this post goes further.

The question most organizations can’t answer: ‘Who accessed your sovereign environment in the last 90 days, from which countries, and under which legal jurisdictions?’

Was operative Souveränität eigentlich bedeutet

Operational sovereignty is not about where data lives. It’s about who runs the environment – and who can reach it. It covers three things that most sovereignty programs treat as implementation details rather than first-class concerns:

• Personnel access and jurisdiction. Every person who can access your sovereign environment – for support, maintenance, monitoring, or incident response – operates under a defined legal jurisdiction. If a support engineer in a country subject to a foreign data access law can reach your systems, the sovereignty of your infrastructure is only as strong as that engineer’s legal exposure.

Most organizations, when they audit this for the first time, find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.

• Third-party and vendor access. Your sovereignty boundary extends to every vendor, managed service provider, and software platform with access to your sovereign environment. ITSM platforms, monitoring tools, SIEM systems – if these sit outside your sovereignty boundary but have access to data or metadata within it, you have a gap that data locality controls cannot close.
• Telemetry, billing, and control-plane traffic. Data sovereignty programs focus on primary data. Operational sovereignty requires mapping where everything else goes: the telemetry your infrastructure generates, the metadata your monitoring systems collect, the billing data your provider processes. These flows can cross jurisdiction boundaries even when primary data doesn’t – and they are rarely mapped.

Why This Pillar Is Harder To Certify – and Why That Matters

Data locality is relatively straightforward to document. You can point to a storage region, a data residency agreement, a third-party audit. Operational sovereignty doesn’t have the same paper trail. There is no certification that guarantees the jurisdictional status of every support engineer who might access your environment.

This is precisely what makes it both the hardest pillar to audit and the most important to get right. It also connects directly to the minimum viable sovereignty challenge: applying the right operational controls to the right workloads requires knowing what those controls are – and operational sovereignty is where that knowledge is most commonly absent.

Die Dimension der Lieferkette

NIS2, das die Cybersicherheitsverpflichtungen auf die Sektoren Energie, Verkehr, Gesundheitswesen und digitale Infrastruktur ausweitet, verpflichtet Organisationen nun dazu, die Cybersicherheitspraktiken ihrer Technologieanbieter zu bewerten. Für Souveränitätsprogramme hat dies direkte Auswirkungen: Die Haltung der Anbieter in Bezug auf Souveränität ist nicht länger nur eine nette Geste bei der Beschaffung. Sie ist eine überprüfbare Anforderung.

Das bedeutet, dass Sie jedem Anbieter innerhalb Ihrer Souveränitätsgrenzen neue Fragen stellen müssen: Wo befindet sich Ihr Supportpersonal? Unter welcher rechtlichen Zuständigkeit arbeitet es? Was geschieht mit den Zugriffsrechten auf meine Umgebung, wenn Ihr Unternehmen von einem Nicht-EU-Unternehmen übernommen wird?

So sieht es gut aus

Ein operativ souveränes Umfeld weist vier Merkmale auf, die sich nicht nur dokumentieren, sondern auch nachweisen lassen:

• Every access pathway into the sovereign environment is mapped – not just primary access, but vendor access, support access, and monitoring system access.
• Der Zugriffsstatus jeder Person oder jedes Systems mit diesem Zugriff wird dokumentiert und in festgelegten Abständen überprüft.
• Telemetrie-, Metadaten- und Control-Plane-Datenverkehrsströme werden erfasst und entweder innerhalb der Hoheitsgrenze gehalten oder ausdrücklich geprüft und als außerhalb des Geltungsbereichs liegend akzeptiert.
• The organization can answer the ninety-day access question – precisely, with evidence.

One more thing: Operational sovereignty doesn’t end at access control. If recovery requires personnel who operate outside your sovereignty boundary, the posture fails at the moment of an incident. That’s the subject of the fourth post in this series. Der „„„Digital Sovereignty Readiness Report“““ enthält eine direkte Bewertungsfrage zur operativen Souveränität.

FAQs

Q: What is operational sovereignty?

A: Operational sovereignty addresses who manages and accesses an environment, including personnel, vendors, and support systems. It extends beyond where data is stored.

Q: Why is operational sovereignty commonly overlooked?

A: Many organizations focus primarily on data location and encryption. Access pathways, support personnel, and telemetry flows are often not fully audited.

Q: How do vendors impact sovereignty posture?

A: Vendors and managed service providers may have access to sensitive systems or metadata. Their legal jurisdictions and operational practices can affect overall sovereignty compliance.

Q: Why are telemetry and metadata important?

A: Even if primary data remains local, telemetry and metadata may cross jurisdictional boundaries. These flows can create compliance risks if left unmanaged.

Q: What does a strong operational sovereignty model include?

A: It includes mapped access pathways, documented jurisdictional controls, audited vendor access, and visibility into all telemetry and metadata flows.

Alex Zinin is VP/GM, Managed Service Providers, at Commvault.

Die wichtigsten Erkenntnisse

• Bei souveränen Architekturen wird häufig der Schwerpunkt eher auf Audits und Zugriffskontrollen als auf die Wiederherstellungsbereitschaft gelegt.
• Personal für die Wiederherstellung, Backup-Systeme und Modelle zur Verwahrung von Schlüsseln können bei Vorfällen zu Lücken in der Souveränität führen.
• Einheitliche Kontrollmaßnahmen in Primär- und Wiederherstellungsumgebungen sind unerlässlich.
• Eine auf staatliche Anforderungen ausgerichtete Widerstandsfähigkeit erfordert erprobte Wiederherstellungsverfahren unter realistischen Bedingungen.

Picture the moment. The attack has already happened. The incident response team is assembling. Someone must decide which systems come back first, in what order, using the correct recovery points.

And then someone realizes: The personnel with recovery system access are based in a different country. Worse, the recovery environment itself (hosted in a cloud region, a partner datacenter, or a secondary site) was never subject to the same sovereignty controls as the primary data.

The practice wasn’t subject to the same sovereignty controls as the primary data. The regulator is asking for status. The clock is running.

This is the scenario most sovereign architectures were not designed for – and the one the „„Digital Sovereignty Readiness Report““ calls out directly: most sovereign applications are designed for the audit, not the incident.

Most sovereign applications are designed for the audit, not the incident. The difference becomes visible at the worst possible moment.

Der blinde Fleck der Erholung in der Architektur der Staatsfinanzen

Sovereignty programs are built around access control – who can reach the data, under what authority, through what pathway. That architecture is necessary. It is not sufficient. And it connects directly to the operational sovereignty gaps die im dritten Beitrag dieser Reihe beleuchtet wurden: If the people who run your environment operate outside your sovereignty boundary, that problem doesn’t disappear during an incident. It becomes the problem.

What access control leaves unanswered is the harder question: What happens after an incident, when recovery is not just a technical operation but a legally constrained one?

A ransomware attack on a regulated European organization doesn’t simply create a recovery problem. It creates a recovery problem that must be solved within a jurisdiction, using personnel with appropriate authorizations, against recovery points that can be demonstrated to be clean and uncompromised.

The sovereign architecture designed to protect the data can make recovery harder if resilience wasn’t built into the original design.

Die spezifischen Ausfallarten

The ways sovereign recovery architectures fail are predictable – and common:

• Recovery personnel outside the sovereignty boundary. The engineers who know the recovery systems may operate in a different jurisdiction. Under pressure, using them is the path of least resistance. It is also a sovereignty violation at the moment it is least convenient to have one.
• Backup infrastructure without matching controls. Primary sovereign environments are carefully controlled. Backup infrastructure – particularly older or secondary environments – is frequently not subject to the same sovereignty requirements. If recovery points are stored or processed outside the boundary, compliant recovery is not available from compliant infrastructure.
• Key custody under crisis conditions. Hold-your-own-key arrangements are designed for normal operations. Under crisis conditions – with primary systems compromised and time pressure acute – the key custody model that works in a routine maintenance window may become an obstacle to recovery. If this hasn’t been tested, it’s an assumption, not a control.
• Cross-environment governance gaps. Organizations operating across multiple sovereign tiers – which is most of them – often have strong controls in primary environments and weaker controls in secondary environments that are also part of the recovery path. Consistency across the full estate is what auditors will look for. Gaps in secondary environments become visible exactly when consistency matters most.

Warum staatliche Kontrollen die Erholung erschweren können

The same controls that make a sovereign environment defensible to an auditor can make it harder to recover from. Data movement restrictions that prevent unauthorized exfiltration also constrain recovery orchestration. Key custody arrangements that ensure no provider can access your data without authorization also add friction when you need to restore quickly.

None of this means these controls are wrong. It means they have to be designed with recovery in mind from the start – not added to an architecture where recovery was an afterthought. This is the core of the minimum viable sovereignty principle: Calibrating controls to actual requirements includes recovery requirements, not just access control requirements.

Was „Sovereignty-Ready Resilience“ erfordert

• Clean recovery validation. Proving that recovery points are free from compromise before restoring to production – not just recent, but uncompromised. In a ransomware scenario, a recent backup may itself be compromised. The ability to identify and restore from a known-clean recovery point, validated before it’s needed, is a sovereignty requirement, not just a disaster recovery requirement.
• Cross-environment governance. Consistent sovereignty controls and audit evidence across the full estate – not just the primary sovereign deployment. Every environment in the recovery path must meet the same requirements as the primary environment.
• Tested under realistic conditions. Regular exercises that validate recovery under the conditions that will actually exist during an incident: the legal constraints that apply, the personnel who are available, the recovery points that are clean. An annual disaster recovery test that doesn’t account for sovereignty constraints is not a sovereignty-ready exercise.

Die Frage, die Sie Ihrer „Sovereignty Review“ hinzufügen sollten

There is a direct way to assess whether your recovery architecture meets the same sovereignty requirements as your primary data environment: Ask it as a question and require an honest answer.

Can you recover your sovereign data, cleanly, within defined tolerances, using personnel operating within your sovereignty boundary, right now – under real conditions, not a controlled exercise?

For most organizations, the honest answer reveals a gap. The organizations that find it now – before the incident – will be best prepared with evidence when the regulator asks for it. The ones that don’t will be building it under pressure, in front of the people they least want to disappoint.

The „„Digital Sovereignty Readiness Report“““ enthält eine Frage zur Bewertung der Architektur für die direkte Wiederherstellung.

FAQs

Q: Why is recovery important to digital sovereignty?

A: Sovereignty is incomplete if organizations cannot recover data within the same legal and operational boundaries used to protect it.

Q: What are common sovereign recovery failures?

A: Common failures include recovery personnel operating outside the sovereignty boundary, backup infrastructure lacking matching controls, and inconsistent governance across environments.

Q: How can key custody complicate recovery?

A: Hold-your-own-key models strengthen security during normal operations, but they can slow recovery efforts during incidents if not properly tested.

Q: What is clean recovery validation?

A: Clean recovery validation confirms that recovery points are free from compromise before systems are restored. This is especially important in ransomware scenarios.

Q: How should organizations test sovereignty-ready resilience?

A: They should conduct realistic exercises that account for legal constraints, operational availability, and validated recovery points – not just standard disaster recovery testing.

Alex Zinin is VP/GM, Managed Service Providers, at Commvault.

Die wichtigsten Erkenntnisse

• Bei der „Minimum Viable Sovereignty“ (MVS) geht es darum, für die jeweiligen Workloads das richtige Maß an Kontrolle anzuwenden.
• Die Gleichbehandlung aller Workloads kann zu unnötiger Komplexität und Kosten oder zu unzureichendem Schutz führen.
• Unternehmen lassen sich in der Regel in drei Souveränitätsprofile einteilen: „True Sovereign“, „Regulated Enterprise“ und „Hybrid Multi-Cloud“.
• Eine einheitliche Governance über gemischte Umgebungen hinweg ist eine der größten betrieblichen Herausforderungen.

There is a version of the digital sovereignty conversation that leads organizations somewhere expensive, operationally burdensome, and – if they’re being honest – further than their actual obligations require. Maximum sovereignty sounds responsible. In practice, it’s often a miscalibration.

There is an equally common version that leads somewhere dangerously thin – controls that satisfy a checklist but wouldn’t survive an audit, an incident, or a regulator who has stopped accepting documented intent as proof of demonstrated control.

The organizations that get sovereignty right tend to do something more rigorous and more practical than either extreme: They ask what they actually owe, to whom, and for what. Then they build to that standard – no more, no less.

This is the discipline of MVS, introduced in the „„Digital Sovereignty Readiness Report““  and developed in full here.

MVS isn’t a shortcut. It’s a recognition that the goal is the right level of control, applied consistently, across every workload that requires it.

Nicht alle Workloads sind gleich

The starting point for an MVS approach is workload classification – and most organizations skip it entirely.

A trading system processing regulated financial data carries fundamentally different sovereignty obligations than an internal HR collaboration tool. A database holding personal data of EU citizens is subject to a different legal and regulatory regime than a development environment running anonymized test data.

Treating all of these identically – either by applying maximum sovereign controls across the board or by assuming a single deployment model covers everything – is how organizations end up either over-engineered or under-protected.

The right question before any deployment decision: What does this workload require across each of the four sovereignty pillars? The Readiness Report includes a self-assessment structured around exactly that question.

The Three Profiles – and What They Actually Need

Regulierte Unternehmen lassen sich in drei erkennbare Profile einteilen, die jeweils unterschiedliche Hauptantriebsfaktoren und Investitionsprioritäten aufweisen.

• The True Sovereign. Government agencies, defense contractors, and critical national infrastructure operators. For these organizations, sovereignty is not a compliance requirement – it is an operational mandate. Maximum control over every dimension of the technology stack is often legally required, and the cost tradeoffs are accepted because the alternative is not.
• The Regulated Organization. Financial services firms, healthcare organizations, energy companies. These organizations face binding requirements from DORA, NIS2, GDPR, and sector-specific frameworks. Compliance obligations may also map to EU certification schemes – including EUCS, EUCC, BSI C5, and SecNumCloud – depending on sector and deployment context.

on-negotiable in certain areas – particularly around data residency, operational access controls, and recovery within jurisdictional boundaries. But not every workload carries the same obligation.

• The Hybrid Multi-Cloud Organization. Organizations with existing hyperscaler investments facing increasing sovereignty pressure from customers, regulators, or procurement requirements. Their challenge is not wholesale migration – it’s layering sovereign controls onto a mixed estate and maintaining consistent governance across it.

Die Kosten einer falschen Kalibrierung

Over-engineering sovereignty creates its own operational risks. Organizations that apply maximum sovereign controls to workloads that don’t require them absorb cost and complexity that serves no regulatory or business purpose.

Under-engineering is the more common failure mode, and the more dangerous one. It typically doesn’t show up until the audit arrives – or, more seriously, until an incident occurs and recovery becomes a legally constrained problem. (That failure mode is the subject of the vierten Beitrags dieser Reihe) umfasst.

Ein praktischer Ausgangspunkt

Ein MVS-Ansatz umfasst drei Schritte:

1. Classify workloads by their actual sovereignty requirements across each pillar – don’t start with deployment models.
2. Ordnen Sie jede Workload-Klasse der Bereitstellungsstufe zu, die diese Anforderungen erfüllt, und zwar über das gesamte Spektrum hinweg – von Regionen öffentlicher Hyperscaler über souveräne Public Clouds bis hin zu lokal verwalteten Umgebungen.
3. Govern the resulting mixed estate consistently – controls, audit evidence, and recovery capabilities must be demonstrable across the full environment, not just the most-sovereign tier.

The third step is where most programs struggle. Maintaining consistent sovereignty controls across a mixed estate is an operational governance challenge – and specifically the domain of Operational Sovereignty – dem Thema des dritten Beitrags dieser Reihe, der Säule, die in den meisten Strategien erst nachträglich berücksichtigt wird.

Nutzen Sie die Selbsteinschätzung im„„Digital Sovereignty Readiness Report“““, um Ihre aktuelle Situation in allen vier Säulen zu ermitteln.

FAQs

Q: What is minimum viable sovereignty (MVS)?

A: MVS is the practice of applying sovereignty controls based on actual business and regulatory needs. It is intended to help avoid both over-engineering and under-protection.

Q: Why is workload classification important?

A: Different workloads carry different regulatory and operational obligations. Classifying workloads helps organizations apply the appropriate level of sovereignty controls.

Q: What are the three common sovereignty profiles?

A: The three profiles are true sovereign organizations, regulated organizations, and hybrid multi-cloud organizations. Each has distinct operational and compliance requirements.

Q: What risks come from over-engineering sovereignty?

A: Excessive controls can increase operational complexity and costs without delivering meaningful compliance or business value.

Q: Why do mixed environments create governance challenges?

A: Organizations often operate across multiple cloud and infrastructure models. Maintaining consistent controls, audit evidence, and recovery standards across all environments is difficult.

Ruben Renders is Solutions Director, MSP, at Commvault.

Die wichtigsten Erkenntnisse

• Data residency addresses where data is stored, but digital sovereignty also requires control over access, operations, and proper understanding of jurisdictional implications.
• Operational sovereignty is often the weakest and least-audited part of most sovereignty programs.
• A complete sovereignty posture depends on four pillars: data locality, technological sovereignty, operational sovereignty, and jurisdictional sovereignty.
• Sovereignty is not binary; organizations must define a posture aligned to their regulatory and operational obligations.

Here is a question worth sitting with: When your organization made its sovereignty decision, what exactly did it decide?

For most, the answer is some version of the same thing. Pick a region. Move the workloads. Choose a cloud provider with data centers in-country. Check the box. The question of where data lives was answered, and the sovereignty conversation was considered closed.

But it wasn’t closed. It had barely started.

Data residency answers one question: Where? Digital sovereignty asks three more – who, how, and under what conditions?

The conflation of residency with sovereignty is understandable. Hyperscalers have made region selection feel like a sovereignty decision. Compliance checklists ask where data is stored. Regulatory guidance, at least in its earlier iterations, focused heavily on geography.

Choosing a sovereign cloud region is a real thing – it matters, it has operational implications, and it’s a necessary first step. But it is only a first step. And most organizations stopped there.

What Residency Doesn’t Answer

Think of it this way: Choosing a sovereign cloud region is like buying a safe. It tells you where your valuables are stored. It says nothing about who has a copy of the combination, who manufactured the safe, which country’s laws govern the manufacturer, or whether you can open it if compelled to.

Region selection answers one question. Three more remain entirely open – and these are the questions regulators, procurement committees, and auditors are now asking with increasing precision:

• Who can operate your environment, and from where? Whether your cloud provider’s support personnel are subject to foreign jurisdiction is a sovereignty question that data residency cannot resolve. A routine maintenance window performed by a support engineer in a different legal jurisdiction is an access pathway your residency policy doesn’t cover. This is the domain of Operational Sovereignty – the hardest pillar to audit and the most commonly overlooked.
• Under what legal regime can your data be accessed? A foreign technology provider operating infrastructure in-country does not automatically remove the reach of their home jurisdiction’s law. The extraterritorial reach of foreign legal regimes is a risk that geography alone cannot eliminate.
• Can you recover your data if something goes wrong? Most sovereignty programs are built around access control. Very few address recovery – whether your data can be restored cleanly, within defined tolerances, by personnel who operate within your sovereignty boundary. That gap is where sovereignty postures most commonly fail under real conditions.

The Framework that Fills the Gap

A complete sovereignty posture spans four interdependent pillars. The „„Digital Sovereignty Readiness Report““ – available at readiverse.com – walks through each in full. In brief:

• Data locality addresses where data and metadata actually travel.
• Technological sovereignty covers control over encryption, key custody, and architecture portability.
• Operational sovereignty covers who runs the environment and from where.
• Jurisdictional sovereignty establishes the legal framework governing and affecting all of the above.

No single pillar is sufficient. A strong data locality posture with weak operational controls is not sovereignty – it is residency with unexamined risk.

What makes the framework useful is not its complexity. It’s the questions it generates. When an organization maps its current posture against all four pillars for the first time, it almost always finds gaps it didn’t know were there – not because the controls are absent, but because the questions were never asked.

Sovereignty Is a Sliding Scale

One more thing worth naming: Sovereignty is not a binary state. There is no certification that grants it and no single deployment model that guarantees it. It is a posture – a set of deliberate, auditable decisions. And the right level of that posture varies by organization, by workload, and by what you actually owe regulators and customers.

That calibration is what minimum viable sovereignty is about – the subject of the second post in this series.

Regulatory confidence is built long before the audit itself – through clearly defined requirements, not assumptions tied to geography.

Download the „„Digital Sovereignty Readiness Report““ for the four-pillar framework and a practical self-assessment tool.

FAQs

Q: What is the difference between data residency and digital sovereignty?

A: Data residency focuses on where data is physically stored. Digital sovereignty goes further by addressing who can access the data, how systems are operated, and exposure to which jurisdictions may create legal risk.

Q: Why is region selection not enough for sovereignty?

A: Choosing a cloud region only addresses geography. It does not resolve issues related to operational access, legal risks exposure, or recovery capabilities.

Q: What are the four pillars of digital sovereignty?

A: The four pillars are data locality, technological sovereignty, operational sovereignty, and jurisdictional sovereignty. Together, they create, what we believe, is a more complete framework for assessing sovereign readiness.

Q: Why is operational sovereignty difficult to manage?

A: Operational sovereignty involves monitoring who can access systems, where they operate from, and under which legal regime. These controls are harder to audit than simple data location requirements.

Q: Is digital sovereignty a fixed certification?

A: No. Sovereignty is an ongoing posture based on deliberate, auditable decisions that vary by organization, workload, and regulatory environment.

Ruben Renders is Solutions Director, MSP, at Commvault.

Die wichtigsten Erkenntnisse

• Vishing attacks have surged dramatically, with organized groups industrializing social engineering to gain initial access through help desks.
• Attackers quickly pivot from compromised human accounts to persistent machine identities like OAuth tokens and service accounts.
• Most organizations lack governance and visibility over non-human identities (NHI), creating a major security blind spot.
• Effective readiness depends on correlating identity signals and treating machine identities as high-risk assets.
• True resilience requires the ability to detect and roll back unauthorized privilege changes before attackers establish persistence.

Your help desk staff just got a phone call. The caller knew the employee’s name, their manager, and the last four digits of their badge number. They asked for a password reset. Standard procedure. The IT rep complied.

That call was a fraud. And the attacker is now inside.

Voice phishing – vishing – jumped im Jahr 2025 um 449 %.. Adversary groups have turned social engineering into a scalable operation: recruiting callers, writing scripts, andpaying $500 to $1,000 per successful help desk impersonation. They’re not looking for your data. They’re looking for a foothold.

Once inside, attackers don’t linger on the human account. They move laterally – stealing OAuth tokens, creating new administrative service accounts, embedding access in machine-layer credentials that nobody watches. Unlike human passwords, those credentials are rarely rotated. They don’t trigger login alerts. They can survive a full remediation of the original compromised user.

By the time your security team closes the ticket on the help desk incident, the attacker may have been quietly persistent in your environment for weeks. The governance gap makes it worse.

Fewer than 25% of organizations have formal policies for creating or decommissioning NHIs – the service accounts, API keys, and OAuth tokens that now outnumber human users by 144 zu 1. Nearly all of them carry permissions far beyond what their function requires.

Most organizations have almost no confidence in their ability to detect an attack targeting this layer. That’s not a prevention failure. It’s a recovery planning failure.

What Readiness Looks Like

Prevention at the help desk matters – training, callback verification, out-of-band confirmation. But it isn’t enough on its own. Attackers are industrializing faster than awareness programs can keep pace.

Readiness means correlating the signals: A help desk interaction followed immediately by a multi-factor authentication (MFA) reset or a new token creation is a high-probability indicator of compromise.

It means treating machine identities as Tier 0 assets – governing their creation, scoping their permissions, and monitoring for unauthorized escalation. And it means having the ability to detect and roll back malicious privilege changes quickly, before they become the new normal.

Explore how Commvault identity resiliencesupports rapid detection, rollback, and recovery of your identity environment.

FAQs

Q: What is a vishing attack in the context of enterprise security?

A: Vishing (voice phishing) uses phone calls to impersonate employees and manipulate IT help desks into granting access – typically through password or MFA resets. It’s increasingly industrialized, with organized groups recruiting callers and using pre-written scripts to maximize success rates.

Q: Why do attackers pivot to machine identities after a vishing entry?

A: Human accounts get remediated. NHIs – OAuth tokens, service accounts, API keys – are more persistent and rarely rotated, often invisible to traditional monitoring. Migrating access to the machine layer allows attackers to maintain that persistence long after the original human credential breach is detected and closed.

Q: What does “identity resilience” mean in practice?

A: It means your organization can help detect unauthorized privilege changes in near real time and help restore the identity environment to a trusted state quickly. Detection alone isn’t sufficient – the ability to roll back malicious activity and verify that machine identities haven’t been tampered with (or if tampered with, to be rolled back to a prior good point in time) is what separates readiness from exposure.

Vidya Shankaran is Field CTO at Commvault.