Puntos Clave

• La resiliencia cibernética depende tanto de la tecnología como de la experiencia de los profesionales encargados de proteger y recuperar los sistemas críticos.
• El aprendizaje continuo ayuda a los equipos de socios a mantenerse al día con las amenazas en constante evolución, los entornos híbridos y las mejores prácticas en materia de resiliencia.
• La Commvault la la Readiverse Academy ofrece formación específica para cada puesto, talleres prácticos y certificaciones diseñadas para desarrollar habilidades de ciberresiliencia aplicables al mundo real.
• Los clientes valoran cada vez más a los socios que les ayudan a ofrecer asesoramiento de confianza, acelerar la preparación para la recuperación y maximizar los resultados en materia de resiliencia.
• Invertir en formación continua ayuda a reforzar las capacidades de los socios, fomenta la confianza de los clientes y contribuye al crecimiento empresarial a largo plazo.

Organizations are facing increasing pressure to defend against sophisticated and ever-changing threats. But they also need to manage complex hybrid environments, enable rapid recovery, and maintain continuous operations. Technology plays a critical role – but it’s not enough on its own.

True resilience depends on the readiness, experience and ongoing development of the professionals designing, implementing and supporting these environments. As resilience operations continues to mature, trusted expertise has become a critical differentiator.

The Growing Importance of Continuous Learning

Cyber resilience environments are constantly evolving – from expanding hybrid infrastructures to increasingly advanced threats and rising recovery expectations.

For partner professionals across sales, consulting, engineering and support, staying current is no longer optional – it’s essential. Continuous learning helps teams:

• Reforzar los conocimientos especializados en resiliencia cibernética.
• Gánate la confianza de los clientes en las conversaciones.
• Mantente al día de las tecnologías en constante evolución y de las mejores prácticas.
• Prepárate para nuevos puestos y oportunidades.

Whether supporting ransomware readiness, designing recovery strategies or navigating complex data environments, skilled professionals play a critical role in helping maintain resilience and operational continuity.

Building Expertise Across the Partner Ecosystem

At Commvault, we recognize that different partner roles require different skills and learning paths.

That’s why la la Readiverse Academy was created – offering role-based learning and outcome-focused certifications across sales, engineering, consulting, architecture and support. Beyond just certification, our courses provide practical expertise that drives real customer outcomes.

The Commvault la la Readiverse Academyofrece:

• Itinerarios de aprendizaje basados en roles.
• Aprendizaje flexible y a tu propio ritmo.
• Prácticas prácticas basadas en situaciones reales.
• Certificaciones que demuestran que estás preparado para el mundo real.

Today, more than 10,000 active learners across the partner ecosystem are building their expertise through la la Readiverse Academy, reflecting the growing importance of cyber resilience skills across the industry.

Why Expertise Matters to Customers

Customers aren’t just investing in technology – they’re investing in outcomes.

They expect confidence in their ability to protect, manage, and recover systems when disruption occurs. They need trusted experts who can help reduce risk, accelerate recovery, and maximize the value of their investments.

Partners with continuously developing teams are better positioned to help:

• Acelera las implementaciones.
• Adaptar las soluciones a las necesidades cambiantes.
• Mejorar la preparación operativa.
• Reforzar la preparación para la recuperación.
• Afrontar retos complejos en materia de resiliencia.

As cyber resilience becomes mission-critical, expertise becomes a key differentiator.

Investing in the Future of Cyber Resilience

The cyber resilience landscape will continue to evolve – and so will customer expectations.

For partner professionals, continuous learning helps drive long-term growth, credibility, and readiness. For partners, it helps strengthen delivery and build trust. For customers, it helps enable better outcomes.

Explore the Commvault la la Readiverse Academy, and start building the expertise that sets your team apart – with role-based learning, hands-on training, and certifications designed for real-world impact.

Preguntas frecuentes

Q: Why is technology alone not enough to achieve cyber resilience?
A: Technology provides the tools needed to protect and recover data, but successful cyber resilience also depends on the people using those tools. Skilled professionals are essential for helping design effective strategies, respond to threats, and enable rapid recovery when disruptions occur.

Q: What role does continuous learning play in cyber resilience?
A: Continuous learning helps professionals stay current with evolving cyber threats, changing technologies, and emerging best practices. It also helps build confidence in customer engagements and prepare teams to address increasingly complex resilience challenges.

Q: What is the Commvault la la Readiverse Academy?
A: la la Readiverse Academy is Commvault’s learning platform that offers role-based training, hands-on labs, flexible learning paths, and certifications. Its programs are designed to help sales, engineering, consulting, architecture, and support professionals develop practical cyber resilience expertise.

Q: How do customers benefit from working with highly trained partners?
A: Customers gain access to trusted experts who can help reduce risk, improve operational readiness, accelerate deployments, and strengthen recovery preparedness. This expertise helps organizations achieve better outcomes from their cyber resilience investments.

Q: Why are certifications important in the cyber resilience field?
A: Certifications help validate real-world knowledge and readiness, giving both partners and customers confidence in a professional’s capabilities. They also support career development and demonstrate a commitment to maintaining current expertise.

Q: How can partners prepare for the future of cyber resilience?
A: Partners can prepare by investing in ongoing education, developing role-specific expertise, and staying aligned with evolving resilience requirements. Building a culture of continuous learning helps teams remain effective as customer expectations and threat landscapes continue to evolve.

Thomas Kestner is Global Director Partner Solutions & Services Enablement, WW Education Services, at Commvault.

There are a lot of conversations happening right now about cyber resilience. Most focus on technology: Detection speed. Recovery architecture. AI-enabled security operations.
All of those things matter. But after sitting down with Dr. Erika Voss, SVP, Global Chief Security & Data Officer at Blue Yonder, and Sam Archey, VP of Trust at Blue Yonder, I kept coming back to something much more fundamental: Trust.
Not trust as a slogan or marketing message, but trust as something operational. Something built deliberately over time and tested in the moments when organizations are under the most pressure.
That distinction can matter because resilience today isn’t just about recovering systems. It’s also about how organizations communicate, how they lead, and how they maintain confidence while uncertainty is still unfolding.
And for a company like Blue Yonder – operating at the center of global supply chains – that challenge becomes even more visible.
Watch the episodio completo.

Puntos clave: ¿Qué implica realmente la confianza cibernética moderna?

• Trust is built through consistency, not perfection. Customers don’t typically expect immediate answers, but they do expect transparency and follow-through.
• La resiliencia es algo práctico, no teórico. La comunicación, la coordinación y los procesos de toma de decisiones pueden ser tan importantes como los controles técnicos.
• Las relaciones sólidas que se establecen antes de que se produzca un incidente pueden determinar la eficacia con la que los equipos responden durante el mismo.
• La resiliencia de la cadena de suministro puede aumentar lo que está en juego, ya que las interrupciones se propagan por ecosistemas interconectados.
• Organizations are increasingly judged not on whether incidents happen – but on how they respond when they do.

Resiliencia y confianza

One thing became clear very early in this discussion: Erika and Sam don’t think about resilience as a standalone security function. They think about it as a trust function.
Most organizations still separate these ideas:

• El equipo de seguridad se encarga de la respuesta técnica.
• El departamento de Comunicaciones se encarga de la gestión de los mensajes.
• El equipo directivo interviene cuando hay que dar un paso más.

But what Blue Yonder has built is much more integrated than that. Their approach recognizes that customer trust is shaped in real time by operational behavior – not just technical outcomes.
And in a supply chain environment, where countless organizations are interconnected, that operational behavior can become incredibly visible. When something breaks inside that ecosystem, the impact rarely stays isolated. 

El momento en el que la confianza se pone realmente a prueba

One of the strongest themes throughout the conversation was how quickly trust can be lost – and how intentional organizations must be to preserve it.
Erika put it bluntly: Customers are no longer evaluating whether companies experience incidents. That’s become table stakes in the modern threat landscape. What they are evaluating is something much more specific: Did they hear it from you first?

That distinction changes how organizations should think about incident response.
For years, the instinct during cyber events was often to hold communication until every detail was verified. But the reality today is that silence can create uncertainty faster than almost anything else.
Customers don’t typically expect complete answers in the first hour. They want acknowledgment. They want presence. They want to know that someone is actively working on the problem and willing to communicate transparently while things are still unfolding.
That’s where operational trust is built. And according to Erika and Sam, those first 60 minutes can matter more than most organizations realize.

Avance: La confianza es fundamental en una crisis

In this moment from the STRIVE conversation, we discuss how the first 60 minutes of response can determine customer confidence, reduce propagation delays, and shape long-term business relationships.

Generar confianza antes de que la necesites

The trust Blue Yonder has built with customers wasn’t created during a single crisis. It was built through repeated interactions over time – through transparency, responsiveness, and operational discipline long before pressure entered the equation.
The same applies internally.
One thing both Erika and Sam emphasize is the importance of relationships between teams before incidents occur. Security, communications, engineering, operations, and leadership need to know how to work together ahead of time. Otherwise, the first real test of collaboration happens during a crisis, which can be the worst possible moment to establish operational alignment.
That’s why they spend so much time focusing on process maturity, stakeholder engagement, and tabletop exercises.
Not because those activities are theoretical. Because they create familiarity.
And familiarity helps reduce friction when pressure rises. 

Por qué los ejercicios de simulación son más importantes de lo que la mayoría de las organizaciones creen

There was a particularly practical section of the conversation around tabletop exercises that I think a lot of organizations need to hear.
Too often, tabletops become compliance activities. Something organizations run once or twice a year to satisfy requirements and move on from. But the way Blue Yonder approaches them is much more operational.
For them, tabletops are rehearsals for coordination.

• ¿Quién toma las decisiones?
• ¿Cómo se produce la escalada?
• ¿Qué socios externos hay que involucrar?
• ¿Cómo interactúan los departamentos jurídico, de comunicación e ingeniería?

Those questions become incredibly important during live incidents. And if teams haven’t worked through them ahead of time, response can slow down immediately.
Sam described how teams begin to understand what it may actually feel like to be pulled into an incident under pressure. That experience matters because it helps build muscle memory – not just for technical teams, but for leadership and operational stakeholders as well.
The organizations that recover most effectively are rarely improvising everything in real time. They’ve practiced.

El lado humano de la resiliencia

What I appreciated most about this conversation was how grounded it was in the human reality of resilience work.
Cyber resilience often gets framed entirely through technology. But people often still determine outcomes.

• Cómo se comunican los líderes.
• Cómo colaboran los equipos.
• Cómo se comportan las organizaciones cuando la información es incompleta.

Those factors help shape customer trust just as much as recovery timelines or technical controls do.
And perhaps the most important lesson from Erika and Sam is that trust isn’t earned during easy moments. It’s earned during uncertainty. During ambiguity. During the moments when organizations have to choose transparency over silence and consistency over perfection.

La conclusión más importante de este debate es que la criptografía poscuántica ya no es un reto tecnológico del futuro.

Se está convirtiendo en un debate sobre la resiliencia en el presente.

Las organizaciones no tienen por qué entrar en pánico ni necesitan renovar todos los sistemas de la noche a la mañana. Pero sí deben empezar a actuar, para aprovechar al máximo el tiempo del que disponen para prepararse.

Las organizaciones que superen con éxito esta transición no serán necesariamente aquellas que cuenten con la criptografía más sofisticada. Serán aquellas que hayan empezado a formarse una idea del tema antes de que llegara la certeza.

Y así es, a menudo, como funciona la resiliencia.

In this discussion, you’ll discover:

• Cómo Blue Yonder se gana la confianza de los clientes.
• Por qué la constancia puede ser más importante que la perfección inmediata.
• El papel de la comunicación durante los incidentes cibernéticos.
• Cómo los ejercicios de simulación refuerzan la resiliencia.
• Por qué los entornos de la cadena de suministro pueden cambiar lo que está en juego en la recuperación tras un ciberataque.

Watch now.

Preguntas frecuentes

Q: Why is trust so important in cyber resilience?

A: Because customers increasingly evaluate organizations based on how they respond during incidents, not simply whether incidents occur.

Q: What does “trust as an operating model” mean?

A: It means trust is continuously reinforced through operational behavior, communication consistency, and transparency – not just during crises.

Q: Why do the first 60 minutes of response matter so much?

A: Early communication can shape customer perception, help reduce uncertainty, and help establish credibility during rapidly evolving situations.

Q: How do tabletop exercises improve resilience?

A: They help teams rehearse coordination, escalation, and communication processes before real incidents occur.

Q: What is the biggest lesson from this discussion?

A: That resilience is typically deeply tied to operational trust, and organizations should build that trust before they need it most.

Q: How can organizations help improve customer trust during incidents?

A: By communicating consistently, prioritizing transparency, and building strong internal coordination long before a crisis begins.

Chris Mierzwa es director sénior de marketing de cartera en Commvault.

Puntos Clave

• La ciberresiliencia en los entornos de MEDITECH va más allá de backup la recuperación; se centra en mantener la prestación de asistencia sanitaria y la continuidad operativa durante las interrupciones.
• Las organizaciones sanitarias se enfrentan a un riesgo considerable de ransomware, por lo que una recuperación rápida y fiable es esencial para el funcionamiento de los servicios clínicos.
• Los enfoques tradicionales de protección de datos a menudo no tienen en cuenta las complejas interdependencias que existen entre los sistemas clínicos, las aplicaciones y los flujos de trabajo.
• Las estrategias de recuperación eficaces deben coordinar la restauración de los sistemas interconectados para minimizar el tiempo de inactividad y el impacto operativo.
• Commvault’s MEDITECH-focused approach helps combine snapshot-based protection, automated recovery workflows, and recovery visibility to strengthen resilience and preparedness.

When ransomware or operational disruption impacts clinical systems, the effects can ripple quickly across the organization, disrupting workflows, slowing staff productivity, and putting timely care delivery at risk. In these moments, the ability to recover quickly and confidently becomes just as important as preventing the disruption in the first place.

That is why Commvault’s approach to protecting MEDITECH environments is centered on recoverability, resilience, and operational readiness, not just data preservation.

Healthcare remains one of the sectors most heavily targeted by ransomware. In a MEDITECH environment, downtime can interrupt medication workflows, delay access to diagnostic information, and force staff into manual workarounds that increase both risk and complexity. In this context, a strategy that looks good on paper is not enough. Health systems need confidence that recovery will perform under real-world pressure.

That is where Commvault can make a meaningful difference.

Por qué la protección de datos tradicional no es suficiente para MEDITECH

Muchas organizaciones siguen basándose en estrategias de protección de datos diseñadas para entornos informáticos generales, en lugar de tener en cuenta las realidades operativas del sector sanitario. La recuperación de MEDITECH requiere conocer las interdependencias entre aplicaciones, el orden de restauración, los puntos de control de validación y la necesidad de volver a poner en funcionamiento los sistemas clínicos con la mínima interrupción posible.

Una estrategia de recuperación eficaz debe ir más allá de la simple restauración de datos. Debe permitir la recuperación coordinada de los sistemas, aplicaciones y flujos de trabajo críticos de los que dependen a diario los profesionales sanitarios. Commvault ayuda a las organizaciones a gestionar esa complejidad gracias a una arquitectura resistente, flujos de trabajo de recuperación optimizados y una mayor visibilidad del estado de preparación para la recuperación.

Cómo ayuda Commvault a proteger a MEDITECH en la práctica

Commvault’s approach to MEDITECH protection is designed to align with the operational realities of these environments. Rather than relying on a one-size-fits-all backup model, the solution helps organizations capture application-consistent protection points for critical MEDITECH workloads while helping minimize disruption to production operations.

This architecture provides healthcare organizations with a practical path to faster, more confident recovery. Snapshot-based protection can support rapid restoration for operational resilience, while longer-term backup retention strengthens options for audit, compliance, and broader cyber preparedness. The result is a model that supports both day-to-day recoverability and resilience planning for more severe disruption.

Cómo se puede aplicar la ciberresiliencia en la práctica

Cuando el ransomware ataca de la noche a la mañana

Imagina un hospital regional que se enfrenta a un ataque de cifrado durante la noche. En ese caso, la capacidad de recuperarse a partir de backup inmutables y ejecutar un plan de restauración estructurado puede marcar la diferencia entre un tiempo de inactividad prolongado y una recuperación controlada. Commvault ayuda a las organizaciones a reducir ese riesgo con opciones de recuperación seguras, diseñadas para restaurar los sistemas críticos de forma rápida y sin problemas.

Cuando la infraestructura de copias de seguridad es objeto de un ataque

Los atacantes intentan cada vez más comprometer la infraestructura de copias de seguridad antes de lanzar el ransomware. Eso hace que la resiliencia arquitectónica sea esencial. Con protección inmutable y opciones de recuperación aisladas, Commvault ayuda a garantizar que los puntos de recuperación limpios sigan estando disponibles incluso cuando los adversarios obtengan acceso a los sistemas de producción.

Cuándo se exige una prueba de recuperación

Las aseguradoras cibernéticas, los auditores y las partes interesadas en el cumplimiento normativo exigen cada vez más pruebas de que las capacidades de recuperación se han probado, están documentadas y son sólidas desde el punto de vista operativo. Commvault respalda esa preparación con flujos de trabajo de validación, informes y pruebas que pueden ayudar a las organizaciones sanitarias a demostrar su resiliencia antes de que se produzca un incidente.

Cómo Commvault contribuye a la resiliencia de MEDITECH

Commvault ayuda a las organizaciones a proteger los volúmenes de las bases de datos de MEDITECH mediante puntos de recuperación coherentes con la aplicación, lo que proporciona una base más sólida para la restauración cuando los sistemas clínicos se ven afectados.

Recuperación diseñada en función de las dependencias de MEDITECH

MEDITECH recovery often involves complex relationships between systems and databases. Commvault’s approach helps support coordinated protection of critical workloads and a recovery model designed to help bring systems back online in the appropriate sequence.

Recuperación validada con retención flexible

Al combinar opciones de recuperación rápida con backup a más largo plazo, Commvault ayuda a los equipos sanitarios a reforzar su resiliencia más allá del periodo inicial de las instantáneas y a desarrollar una estrategia más completa para las pruebas de recuperación, la validación y la preparación.

Mayor visibilidad sobre la preparación para la recuperación

Una estrategia sólida de resiliencia de MEDITECH depende de la claridad operativa. Commvault ayuda a los equipos a centralizar los flujos de trabajo de protección, mejorar la visibilidad sobre el estado de preparación para la recuperación y simplificar la gestión de las tareas críticas de protección de datos.

Preparación normativa y en materia de seguros

Desde procesos de recuperación documentados hasta estrategias de retención que respaldan las discusiones sobre auditorías y cumplimiento normativo, Commvault ayuda a las organizaciones sanitarias a reforzar la documentación de cumplimiento y a demostrar una postura de resiliencia más madura.

Por qué es importante la implementación

Para lograr una resiliencia eficaz en un entorno MEDITECH no basta con elegir la platform adecuada. También es necesario cumplir con los requisitos de implementación validados, garantizar la compatibilidad de la infraestructura y contar con un diseño de protección que refleje cómo funcionan los sistemas MEDITECH en la práctica. Para las organizaciones sanitarias, esa disciplina en la implementación puede ser tan importante como la propia tecnología de recuperación. Una estrategia de resiliencia bien diseñada ayuda a que los equipos puedan llevar a cabo los procesos de recuperación tal y como se espera cuando más se necesitan.

¿Por qué ahora?

Las amenazas de ransomware siguen evolucionando, y los atacantes se centran cada vez más en backup antes de aplicar el cifrado. Al mismo tiempo, las aseguradoras cibernéticas y las partes interesadas en el cumplimiento normativo exigen pruebas de que las capacidades de recuperación se han probado, no solo que las herramientas estén instaladas. Para las organizaciones sanitarias que utilizan MEDITECH, la necesidad de reforzar la resiliencia antes de que se produzca un incidente nunca ha sido tan urgente. Invertir hoy en la preparación para la recuperación puede ayudar a las organizaciones a proteger mejor sus operaciones, acelerar la recuperación y reducir el impacto de las interrupciones cuando más importa.

En el ámbito sanitario, la preparación para la recuperación se reduce, en última instancia, a la confianza: confianza en que los datos críticos están protegidos, confianza en que los sistemas se pueden restablecer en el orden correcto y confianza en que la resiliencia se ha puesto a prueba antes de que se produzca una crisis. Ese es el estándar que Commvault ayuda a las organizaciones a alcanzar en entornos MEDITECH, y es la base para un enfoque más sólido y seguro de la ciberresiliencia.

Las organizaciones pueden reforzar aún más esa base colaborando con un proveedor de servicios gestionados de Commvault especializado en el sector sanitario. Además de la tecnología en sí, los equipos sanitarios tienen acceso a conocimientos especializados que pueden ayudarles a adaptar las estrategias de protección a los requisitos de MEDITECH, llevar a cabo la implementación con mayor confianza y mejorar la preparación operativa continua. Para las organizaciones sanitarias que se enfrentan a la complejidad de MEDITECH, esa combinación de tecnología robusta y experiencia especializada en el sector sanitario puede ayudar a acelerar la preparación y mejorar los resultados de la recuperación cuando más importa.

Reflexiones finales

La recuperación en un entorno MEDITECH va más allá de la simple restauración de los sistemas. Se trata de restablecer los flujos de trabajo clínicos en los que confían los profesionales sanitarios para atender a los pacientes. A medida que las amenazas de ransomware siguen evolucionando y las organizaciones sanitarias se enfrentan a una presión cada vez mayor para demostrar su resiliencia operativa, la Readiness para la recuperación ya no puede considerarse únicamente como un ejercicio de cumplimiento normativo o una mera estrategia de copia de seguridad. Descubre cómo Commvault ayuda a las organizaciones sanitarias a reforzar la resiliencia de MEDITECH, acelerar la recuperación y reforzar la confianza en su capacidad para hacer frente a las interrupciones cibernéticas. Visita nuestrositio de documentación de MEDITECHpara obtener más información.

Preguntas frecuentes

Q: Why is cyber resilience especially important for MEDITECH environments?

A: MEDITECH environments support critical clinical and operational workflows that directly impact patient care. Cyber resilience helps healthcare organizations recover quickly from disruptions while maintaining essential services and minimizing care delivery interruptions.

Q: How does cyber resilience differ from traditional backup and recovery?

A: Traditional backup and recovery focus primarily on restoring data after an incident. Cyber resilience expands that focus to include operational continuity, rapid recovery, and proactive measures that help reduce the impact of disruptions.

Q: Why are traditional data protection solutions often insufficient for healthcare organizations?

A: Many traditional solutions are designed for general IT environments and may not account for the complex interdependencies between healthcare applications, systems, and workflows. As a result, recovery can be slower and more disruptive.

Q: What challenges do ransomware attacks create for healthcare providers?

A: Ransomware can disrupt access to clinical information, delay care delivery, and increase operational complexity. Healthcare organizations need recovery solutions that enable fast restoration and confidence in recovery outcomes.

Q: How does Commvault support MEDITECH protection and recovery?

A: Commvault’s approach is designed around healthcare operational requirements, providing application-consistent protection, automated recovery processes, and visibility into recovery readiness to help reduce downtime.

Q: What benefits do snapshot-based protection and automated recovery provide?

A: Snapshot-based protection can support faster restoration of critical systems, while automated recovery workflows help streamline recovery efforts. Together, they improve operational resilience and strengthen preparedness for future disruptions.

Chris DiRado es directora de Experiencia de Producto en Commvault.

When we talk about cyber resilience, the conversation usually centers on technology: tools, platforms, automation. All of that matters. But when something goes wrong, those aren’t the things that determine how well an organization responds.

People are.

In this episode of STRIVE, I sat down with Dr. Jessica Barker, co-CEO of Cygenta and a leading expert on the human and psychological aspects of cybersecurity. I asked her to discuss a part of resilience that doesn’t always get enough attention – the human side.

What happens when pressure rises, when decisions have to be made quickly, and when teams are forced to work together in ways they may not be used to?

Watch the episodio completopara saber qué tenía que decir.

Puntos clave: lo que nos revela el lado humano

• Technology doesn’t fail alone – people and processes are always part of the outcome.
• La confianza bajo presión viene de la preparación, no del instinto.
• Tener claro quién toma las decisiones ayuda a reducir las dudas durante los incidentes.
• La confianza entre los equipos ayuda a acelerar la respuesta y la recuperación.
• Culture plays a measurable role in resilience – it’s not just tools or architecture.

Cuando el plan se enfrenta a la realidad

Every organization has a plan. It’s documented, reviewed, and often approved at the highest levels. But the real test isn’t how that plan reads – it’s how it holds up when people are under pressure.

Because that’s when things change. Decisions don’t always follow the script. Communication isn’t always clean. Priorities shift in real time. And in those moments, resilience becomes less about process and more about behavior.

Avance: La resiliencia cibernética como norma cultural

In this moment from the episode, Dr. Barker highlights the importance of aligning cybersecurity with organizational values. Rather than positioning security as a blocker, resilient organizations embed it into culture – as an enabler of productivity, positivity, and business growth.

El papel de la confianza

One of the most consistent themes in this conversation is confidence. Not confidence in the tools – confidence in the people using them.

Teams that perform well during incidents aren’t guessing. They’ve seen similar scenarios before. They’ve practiced. They understand how to respond, even when conditions aren’t ideal.

That confidence shows up in small ways with potentially faster decisions, clearer communication, and less second-guessing. And over time, those small differences can add up to a significantly stronger response. 

La toma de decisiones bajo presión

When something goes wrong, speed matters – but clarity matters more.

• ¿Quién puede tomar decisiones?
• ¿Qué autoridad tienen?
• ¿Cuándo deberían pasar el asunto a un nivel superior?

If those answers aren’t clear, teams hesitate. And hesitation creates gaps. One of the most important parts of resilience isn’t just defining processes – it’s defining decision ownership. When people know where they stand, they tend to act faster and with more confidence.

La confianza es el factor multiplicador

Technology can help enable better and faster responses, but trust can accelerate them. In most organizations, teams operate in their own lanes. Security focuses on threats, infrastructure focuses on systems, and operations focuses on recovery.

That separation works – until an incident forces everyone together. That’s where trust becomes critical. Teams that trust each other:

• Comparten información con más libertad.
• Colabora de forma más eficaz.
• Céntrate en los resultados en lugar de en quién es el responsable.

Sin esa confianza, incluso los procesos mejor diseñados pueden fallar.

Por qué la preparación sigue siendo importante

It’s easy to assume that strong individuals can carry a response. But even experienced teams rely on preparation, such as tabletop exercises, simulations, cross-team drills, and so on. They’re what build the muscle memory that teams rely on when real incidents occur. Without that preparation, even the most capable teams are forced to improvise.

La conclusión más importante de este debate es que la criptografía poscuántica ya no es un reto tecnológico del futuro.

Se está convirtiendo en un debate sobre la resiliencia en el presente.

Las organizaciones no tienen por qué entrar en pánico ni necesitan renovar todos los sistemas de la noche a la mañana. Pero sí deben empezar a actuar, para aprovechar al máximo el tiempo del que disponen para prepararse.

Las organizaciones que superen con éxito esta transición no serán necesariamente aquellas que cuenten con la criptografía más sofisticada. Serán aquellas que hayan empezado a formarse una idea del tema antes de que llegara la certeza.

Y así es, a menudo, como funciona la resiliencia.

En este episodio de STRIVE, hablamos de:

• Cómo influye el comportamiento humano en la respuesta ante incidentes.
• Por qué es importante tomar decisiones con claridad cuando estás bajo presión.
• ¿Qué diferencia a los equipos seguros de sí mismos de los que solo reaccionan?
• Cómo influye la cultura en los resultados de la recuperación.
• En qué deberían centrarse las organizaciones para reforzar su resiliencia.

Ver ahora.

If you’re thinking about resilience beyond technology, this is a conversation worth your time.

Preguntas frecuentes

Q: Why is the human side of resilience important?

A: Because technology alone doesn’t determine outcomes – people do. Their decisions, communications, and executions under pressure are the keys to success.

Q: What role does preparation play in resilience?

A: Preparation helps build confidence and muscle memory, allowing teams to respond more effectively in real scenarios.

Q: How does trust impact incident response?

A: Trust helps enable faster collaboration, clearer communication, and more efficient decision-making across teams.

Q: Why is decision ownership critical?

A: Without clear ownership, teams hesitate, which can slow response and increase risk.

Q: Can strong tools compensate for weak processes?

A: No. Tools support resilience, but without strong processes and alignment, they can’t deliver effective outcomes.

Q: Where should organizations start improving?

A: Focus on cross-team alignment, clear decision-making structures, and regular scenario-based testing.

Darren Thomsonis Vice President and Chief Technology Officer, EMEA, at Commvault.

For years, recovery planning followed a familiar pattern. Build the plan, document the steps, and assume it will work when needed. For a long time, that approach held up. Hardware failures, isolated outages, even natural disasters – these were scenarios organizations could anticipate and plan for with some level of confidence.
But the equation has changed.
In this episode of STRIVE, I sat down with Commvault’s Jason Cray, Principal Product Experience, to explore a reality we continue to see across organizations of all sizes: Most don’t fail because they lack a recovery plan. They fail because they’ve never proven that plan will hold up under real pressure.
Watch the episodio completo.

Puntos clave: Por qué fracasan los planes de recuperación

• A documented plan isn’t the same as a proven one. If it hasn’t been tested in realistic conditions, it’s still an assumption.
• Recovery is a team sport. Security, infrastructure, and operations must align – or recovery slows down.
• Most investment still happens “left of boom.” Prevention matters, but recovery readiness often gets overlooked.
• Las pruebas sacan a la luz las carencias y generan confianza. Sin ellas, las organizaciones se quedan solo con la esperanza.
• La resiliencia es una disciplina operativa. Requiere iteración, comunicación y mejora continua.

The Problem With ‘It Should Work’

On paper, recovery looks straightforward. You define when to recover to, what needs to come back, and where it should be restored. The process appears logical, structured, and manageable.
But as Jason points out, that simplicity rarely survives real-world conditions.
Plans are written in controlled environments, but they’re executed in chaos. When an incident hits, teams aren’t calmly stepping through documentation – they’re reacting, troubleshooting, and trying to align in real time. That’s where the gap emerges. Not between tools and technology, but between expectation and execution.

Avance: ¿Por qué fracasan los planes cuando hay presión?

In this moment from the conversation, Jason and I break down why having a plan isn’t enough – and what it actually takes to know a plan will work when it matters.

We’ve Seen This Before

What’s interesting is that this isn’t a new problem; it’s a familiar one, just in a different context.
If you go back to the early days of disaster recovery, organizations followed a similar pattern. Plans existed, but testing was inconsistent at best. Jason shared an example of spending an entire night helping a client pass a disaster recovery test they thought they were ready for. The plan looked solid. The execution told a different story.
Over time, organizations adapted. They tested more frequently, introduced failover exercises and, in some cases even ran production from secondary environments to prove readiness. That shift from assumption to validation is exactly what una ciberresiliencia now requires.

El primer problema: la comunicación

If there’s one issue that consistently surfaces, it’s communication.
In many organizations, responsibilities are clearly defined – security handles prevention, infrastructure manages systems, and operations owns recovery. Individually, each team may be doing exactly what they’re supposed to do.
But recovery doesn’t happen in isolation. It depends on how well those teams work together when something goes wrong.
As Jason describes, too often it becomes a handoff model: “We’ve done our part, now it’s someone else’s turn.” That approach introduces delays, confusion, and ultimately risk. During a cyber event, coordination matters more than ownership.

The ‘Left of Boom’ Problem

Another pattern we continue to see is the imbalance in where organizations focus their efforts.
There’s significant investment in prevention – security tools, detection platforms, and defensive strategies designed to stop an attack before it happens. That investment is necessary, and it plays a critical role.
But far less attention is given to what happens after the event.
The assumption is that if enough effort is spent on prevention, recovery becomes a secondary concern. In reality, the opposite is true. At some point, something gets through. And when it does, recovery becomes the defining factor in how an organization responds.

De la esperanza a la evidencia

This is where the mindset needs to shift.
It’s not about adding more tools or rewriting documentation. It’s about moving from a model based on hope to one grounded in evidence.
Jason highlights a key observation: The organizations that handle disruption well aren’t the ones that avoid incidents – they’re the ones that experience less impact when those incidents occur. They’ve tested their processes. They’ve validated their assumptions. They understand where their gaps are.
Most importantly, they’ve built confidence – not by believing the plan will work, but by proving it.

Empieza poco a poco y ve cogiendo impulso

For many teams, the challenge isn’t understanding the problem – it’s knowing where to begin.
The answer isn’t to overhaul everything at once. It’s to start small and build from there.
Focus on one or two critical services. Understand what’s required to recover them. Bring together the teams responsible for those systems and test the process end-to-end. From there, expand the scope and continue refining.
This approach does more than improve recovery – it builds alignment, reinforces communication, and creates the foundation for broader resilience.

La realidad: ningún plan sobrevive al primer contacto

One of the most honest moments in our discussion was this: Even the best plan won’t work exactly as written.
That’s not a failure – it’s expected.
Jason puts it simply: If you don’t have a plan, you will fail. But even if you do have one, it won’t unfold perfectly in the moment.
What matters is how prepared to adapt your teams are. Testing creates that adaptability. It builds the muscle memory needed to respond effectively when conditions don’t match expectations.

La conclusión más importante de este debate es que la criptografía poscuántica ya no es un reto tecnológico del futuro.

Se está convirtiendo en un debate sobre la resiliencia en el presente.

Las organizaciones no tienen por qué entrar en pánico ni necesitan renovar todos los sistemas de la noche a la mañana. Pero sí deben empezar a actuar, para aprovechar al máximo el tiempo del que disponen para prepararse.

Las organizaciones que superen con éxito esta transición no serán necesariamente aquellas que cuenten con la criptografía más sofisticada. Serán aquellas que hayan empezado a formarse una idea del tema antes de que llegara la certeza.

Y así es, a menudo, como funciona la resiliencia.

There’s much more we cover in this STRIVE conversation, including:

• ¿Por qué los planes de recuperación suelen fracasar a pesar de estar bien documentados?
• ¿Qué diferencia a las organizaciones que se recuperan de forma eficaz?
• Cómo afectan las deficiencias en la comunicación a la ejecución.
• ¿Por dónde empezar a mejorar la preparación para la recuperación?
• Por qué las pruebas son la base de la resiliencia.

Ver ahora.
If you’ve ever questioned whether your recovery plan would actually work, this is a conversation worth your time.

Preguntas frecuentes

Q: Why isn’t having a recovery plan enough?

A: Because most plans are never validated under real-world conditions. Without testing, they remain assumptions rather than proven strategies.

Q: What causes recovery plans to fail?

A: The most common issues in recovery plans are lack of testing, poor cross-team communication, and gaps between documented processes and real execution.

Q: What does “left of boom” mean?

A: Left of boom refers to the focus on preventing incidents before they occur. Many organizations invest heavily here but underinvest in recovery capabilities.

Q: How often should recovery plans be tested?

A: Recovery plans should be tested regularly and under varied conditions. Testing should simulate realistic scenarios, not just controlled exercises.

P: ¿Por dónde deberían empezar las organizaciones?

A: Start with a small set of critical services, align the responsible teams, and test recovery end-to-end before expanding.

Q: What is the key mindset shift?

A: Moving from hope-based planning to evidence-based validation.

Chris Mierzwa es director sénior de marketing de cartera en Commvault.

We’ve spent years focusing on identity security in the context of people – who have access, what they can do, and how to control it. That model made sense when most activity in the environment was driven by human users.But that’s no longer the case.Machine identities – applications, services, APIs, and automated workloads – now play a central role in how modern systems operate. They authenticate, communicate, and execute tasks, often without direct oversight. And in many environments, they already outnumber human identities by a wide margin.In this episode of STRIVE, I sit down with Dan Conrad, Principal Technologist and a fellow Field CTO at Commvault. We take a closer look at what that shift means – not just from a security perspective, but also from a governance standpoint. And we explore why so many organizations are still treating this as a secondary concern.Watch the episodio completo.

Puntos clave: ¿Hacia dónde se está desplazando el riesgo?

• Las identidades de las máquinas están creciendo más rápido que las identidades humanas, a menudo en órdenes de magnitud.
• Governance models haven’t kept pace, creating blind spots in access and control.
• Visibility is the core challenge. Many teams don’t fully understand how machine identities behave.
• La proliferación de privilegios va más allá de los usuarios, ya que las identidades de las máquinas suelen tener acceso permanente.
• La resiliencia depende de que entendamos y gestionemos el ámbito de actuación de estas identidades de máquina antes de que se conviertan en un problema.

El modelo de identidad ha cambiado

For a long time, identity management was relatively straightforward. You could map users to roles, define access policies, and build controls around predictable behavior. Even with complexity, the model was still anchored in human activity.Machine identities have broken that model.They’re created dynamically, often as part of development or deployment processes. They interact across systems in ways that aren’t always visible or well-documented or audited. And unlike human users, they don’t follow a clean lifecycle – they aren’t onboarded and offboarded in the same structured way.That creates a different kind of challenge. It’s not just about controlling access anymore. It’s about understanding how that access is being used, how it evolves, and how it connects across the environment.

Sneak Peek: You Can’t Phish a Non-Human Identity

In this moment from the STRIVE discussion, Dan describes how attackers aren’t targeting identidades no humanas directly through phishing – they’re malicious actors using compromised human accounts through social engineering, as a steppingstone to escalate privileges and impersonate powerful machine identities. Once inside, techniques like pass-the-hash and overprivileged service accounts allow attackers to move laterally and vertically, even after passwords are reset.

La brecha en la gobernanza

The real issue isn’t that machine identities exist , it’s how they’re governed.In most organizations, there’s a clear process for managing human access:

• Las solicitudes se aprueban.
• Se revisan los permisos.
• Se realiza un seguimiento de los cambios.

There’s a level of discipline that comes from years of focus on user identity. However, machine identities often fall outside of that structure. They’re created quickly to support applications or automation. They’re granted the permissions needed to function, sometimes more than necessary. And over time, those permissions persist. These overprovisioned accesses are rarely audited, reviewed, and more importantly rarely reduced.That’s where the gap forms.It becomes difficult to answer basic questions about access. Not because the information doesn’t exist, but because it hasn’t been organized or managed in a way that makes it usable.

La visibilidad antes que el control

When organizations start to address this problem, the instinct is often to tighten controls.

• Limitar permisos
• Restringir el acceso
• Aplicar nuevas políticas

But control without visibility doesn’t solve much.If you don’t understand how identities are being used, the business context of it in terms of  where they connect, what they interact with, and how they move across systems, then any attempt to restrict them becomes reactive and could result in slowing down business operations.That’s why visibility needs to come first.Once you can see how machine identities behave, patterns start to emerge. You can begin to understand where access is excessive, where dependencies exist, and where risk is concentrated. From there, governance can become more precise and more effective.

Un problema de privilegios diferente

Privilege sprawl isn’t new. Most organizations have spent years trying to manage excessive access among human users.Machine identities introduce a similar issue, but with a different dynamic. Their access is often embedded into systems. It’s persistent, automated, and rarely questioned once it’s in place. That makes it harder to detect and easier to overlook.And when something goes wrong, those identities can become a pathway for malicious actors to exploit

Por dónde empezar

For most organizations, the challenge isn’t awareness, it’s knowing where to start.The first step isn’t a major transformation. It’s building clarity. Understanding how many machine identities exist. Where they’re being created. What permissions they have. How they’re used. And most importantly, confirming that a human user is mapped to a collection of identidades no humanas for the purposes of auditability and accountability.Those questions sound simple, but they’re often difficult to answer. And that’s exactly why they matter. Because once you can answer them, you’re no longer operating in the dark.

La conclusión más importante de este debate es que la criptografía poscuántica ya no es un reto tecnológico del futuro.

Se está convirtiendo en un debate sobre la resiliencia en el presente.

Las organizaciones no tienen por qué entrar en pánico ni necesitan renovar todos los sistemas de la noche a la mañana. Pero sí deben empezar a actuar, para aprovechar al máximo el tiempo del que disponen para prepararse.Las organizaciones que superen con éxito esta transición no serán necesariamente aquellas que cuenten con la criptografía más sofisticada. Serán aquellas que hayan empezado a formarse una idea del tema antes de que llegara la certeza.

Y así es, a menudo, como funciona la resiliencia.

In this installment of STRIVE, we go deeper into how machine identities are changing the way organizations should think about access, governance, and resilience. It’s a practical conversation about what’s happening now – and what needs to change moving forward.Ver ahora.

Recursos

If you’re interested in learning more about this topic, check out this e-book on identidades no humanas.

Preguntas frecuentes

Q: What is a machine identity?

A: A machine identity is a non-human identity used by applications, services, or systems to authenticate and interact with other resources.

Q: Why are machine identities becoming a bigger risk?

A: Because they are increasing in number, often have persistent access, and are not always governed as strictly as human users.

Q: How are they different from user identities?

A: They operate continuously, are embedded in automated workflows, and often lack structured lifecycle management.

Q: What is the biggest challenge organizations face in governing identidades no humanas?

A: Visibility. Many teams don’t have a clear understanding of how many machine identities are created, used, or interconnected.

Q: How does this impact resilience?

A: If compromised, machine identities can enable a malicious actor’s rapid movement across systems, making incidents harder to contain and recover from.

P: ¿Por dónde deberían empezar las organizaciones?

A: By identifying machine identities, understanding their permissions, and building governance practices that match their scale and complexity. And most importantly, confirming that a human user is mapped to a collection of identidades no humanas for the purposes of auditability and accountability

Vidya Shankaran es director técnico de campo en Commvault.

Durante décadas, las operaciones de TI se centraron en el tiempo de actividad:

• Mantén la infraestructura en funcionamiento.
• Cumple tu objetivo de tiempo de recuperación (RTO).
• Cumple tu objetivo de punto de recuperación (RPO).

But modern cyber threats don’t respect infrastructure boundaries – and recovery isn’t just about restoring systems anymore. It’s about restoring clean, trusted data – across teams, under pressure.
In this episode of STRIVE, I sat down with Stephen Foskett, founder and president of the Futurum Group’s Tech Field Day, to discuss an emerging discipline: resilience operations – or ResOps.

And it’s more than a buzzword. It’s a shift in how organizations think about recovery intelligence.
Watch the episodio completo.

Puntos clave: Qué cambia en ResOps

• ResOps moves recovery from infrastructure-focused to business-focused. It’s not just about bringing systems back online – it’s about restoring trusted, usable data.
• Traditional RTO and RPO metrics aren’t enough anymore. El tiempo medio de recuperación completa(MTCR) se está imponiendo como una forma más significativa de medir la resiliencia.
• Breaking down silos is foundational to cyber readiness. Security, infrastructure, and DevOps must operate in sync – not in parallel.
• Resilience is an operational discipline, not a tool. Culture, communication, and coordination matter as much as technology.
• Recovery intelligence is becoming a competitive differentiator. Organizations that recover cleanly and quickly protect revenue, reputation, and trust. 

From IT Ops to ResOps: What’s Changed?

Stephen reflexiona sobre una época anterior de las tecnologías de la información en la que los equipos solían dar soporte a los sistemas sin entender del todo las aplicaciones empresariales que estos alimentaban. La recuperación consistía en restaurar la infraestructura. Hoy en día, ese modelo se queda corto. Los entornos modernos son:

• Distribuido
• Cloud
• Basado en DevOps
• Cuestiones sensibles en materia de seguridad
• Totalmente integrado con las fuentes de ingresos

ResOps acknowledges that recovery is no longer an isolated IT function. It’s a cross-functional discipline that helps connect infrastructure, software development, and security with real business outcomes.

Why Traditional Metrics Don’t Tell the Whole Story

RTO. RPO. These metrics have guided disaster recovery planning for years. But as Stephen explains, restoring quickly isn’t enough if the data you restore isn’t clean.
Enter a more meaningful metric: MTCR. It’s not just how fast you recover; it’s how fast you can recover to a verified, trusted state.
In a ransomware event, that difference matters enormously. Restoring compromised data can restart an attack cycle. ResOps focuses on restoring operational integrity – not just functionality.

Avance: Por qué es importante una recuperación «limpia»

In this moment from STRIVE, Stephen explains why traditional recovery metrics miss the mark – and why recovery is a cross-functional discipline.

La verdadera barrera: los silos organizativos

Technology isn’t usually the biggest blocker to resilience. Structure is. Security teams often report to one executive. Infrastructure teams to another. Application teams to yet another. Each with different priorities, different incentives, and different definitions of success.
ResOps challenges that fragmentation.
Stephen discusses how collaborative workshops and cross-functional alignment are helping break down those silos. Because during a cyber event, organizational misalignment slows recovery more than tooling gaps ever will.

¿Por qué Commvault se está sumando a este debate?

STRIVE isn’t about product features. It’s about how recovery thinking is evolving. ResOpsse alinea estrechamente con lo que observamos sobre el terreno:

• Clientes que tienen dificultades para coordinarse durante los incidentes.
• Organizaciones que están restaurando las infraestructuras, pero que se preguntan por la integridad de los datos.
• La dirección pide indicadores que reflejen el impacto real en el negocio.

The concept of MTCR reframes recovery intelligence around business trust – and that’s where the industry is heading. Recovery is no longer a back-office process. It’s an executive concern.

El futuro de la inteligencia de recuperación

Looking ahead, ResOps is likely to mature rapidly. Over the next 12–18 months, organizations are expected to:

• Integrar mejor los procesos de seguridad y recuperación.
• Adopta nuevos indicadores centrados en la recuperación.
• Incorpora la resiliencia en una fase más temprana del ciclo de vida de las aplicaciones.
• Invierte en una solución inteligente que distinga los datos limpios de los datos comprometidos.

Cyber threats are accelerating. Recovery strategies must evolve at the same pace. ResOps helps provide a framework for doing that.

La conclusión más importante de este debate es que la criptografía poscuántica ya no es un reto tecnológico del futuro.

Se está convirtiendo en un debate sobre la resiliencia en el presente.

Las organizaciones no tienen por qué entrar en pánico ni necesitan renovar todos los sistemas de la noche a la mañana. Pero sí deben empezar a actuar, para aprovechar al máximo el tiempo del que disponen para prepararse.

Las organizaciones que superen con éxito esta transición no serán necesariamente aquellas que cuenten con la criptografía más sofisticada. Serán aquellas que hayan empezado a formarse una idea del tema antes de que llegara la certeza.

Y así es, a menudo, como funciona la resiliencia.

En este episodio, hablamos de:

• En qué se diferencia ResOps de las operaciones de TI tradicionales.
• Por qué el MTCR está ayudando a redefinir los indicadores de recuperación.
• Cómo se ve la alineación organizativa en la práctica.
• Cómo influye la cultura DevOps en la resiliencia.
• Hacia dónde se prevé que avance la inteligencia de recuperación. te informo

Ver ahora.
If you’re responsible for cyber readiness, continuity, or recovery strategy, this is a must-watch discussion.

Preguntas frecuentes

P: ¿Qué es ResOps?

A: ResOps (Resilience Operations) is an emerging discipline that integrates IT operations, security, DevOps, and business stakeholders to help improve recovery intelligence and organizational resilience.

Q: How is ResOps different from traditional IT operations?

A: Traditional IT ops focuses primarily on infrastructure uptime. ResOps expands that focus to include clean data recovery, cross-functional coordination, and business alignment.

Q: What is El tiempo medio de recuperación completa (MTCR)?

A: MTCR measures how quickly an organization can restore verified, clean data and resume safe operations after a cyber event – not just how quickly systems are brought back online.

Q: Why are metrics like RTO and RPO insufficient in modern environments?

A: They measure speed and data currency, but not data integrity. In ransomware scenarios, restoring compromised data can extend disruption.

Q: How can organizations start implementing ResOps?

A: Begin by:

• • Coordinar los equipos de seguridad, infraestructura y DevOps.
  • Evaluar los indicadores de recuperación más allá del RTO y el RPO.
  • Probando los procesos de recuperación limpia.
  • Romper las barreras entre departamentos.
  • Incorporar el enfoque de la resiliencia en una fase más temprana del diseño de los sistemas.

Q: Why is recovery intelligence becoming more important?

A: As cyber threats grow more sophisticated, the ability to recover cleanly, quickly, and confidently directly impacts revenue, customer trust, and regulatory posture.

Darren Thomsonis a Field CTO at Commvault.

Scaling a data-driven company is hard. Scaling one while meeting GDPR requirements, managing thousands of customers, enabling analytics teams, and standing up new infrastructure in under two weeks? That’s a different level of complexity.
In a recent episode of STRIVE, I sat down with Asif Dromi of monday.com and Ben Herzberg of Commvault to unpack what it really takes to operationalize data security at scale – not in theory, but in practice. This isn’t a high-level conversation about best practices. It’s a real-world look at how security, compliance, automation, and infrastructure decisions intersect when the clock is ticking.
Watch the episodio completo.
If you’re a CISO, data leader, architect, or compliance owner, this episode gives you something more valuable than theory. It shows how:

• Una empresa en rápido crecimiento supo hacer frente a las exigencias del RGPD sin frenar la innovación.
• La infraestructura como código puede simplificar las auditorías.
• La automatización reduce el riesgo en lugar de aumentar la complejidad.
• Security and business agility don’t have to compete.

It’s rare to hear directly from operators who’ve done this under real constraints. That’s what makes this STRIVE conversation different.

Puntos clave: Cómo poner en práctica la seguridad de los datos a gran escala

• Compliance and growth don’t have to compete. Monday.com demonstrates how GDPR requirements and rapid expansion can coexist when security is built into architecture from the start.
• Manual permissions don’t scale. Automation does. Infrastructure as code and API-driven access controls can turn governance from a bottleneck into a force multiplier.
• Role-based access must evolve with data usage. As more teams depend on analytics, visibility and fine-grained controls become important to help prevent permission sprawl.
• Operationalized security means visibility. It’s not just about setting policies – it’s about monitoring, auditing, and adapting controls dynamically as environments change.
• Speed is possible when architecture is intentional. A compliant European data warehouse stood up in under two weeks because governance, automation, and tooling were designed to scale.
• Security maturity enables innovation. When permissions, infrastructure, and compliance are programmable, organizations can move faster.

El verdadero reto: crecimiento + cumplimiento normativo + rapidez

For monday.com, the challenge wasn’t just storing European data in Europe. It was:

• Garantizar el cumplimiento del RGPD y la residencia de datos a nivel regional.
• Asegurarse de que los empleados solo accedieran a los datos relevantes.
• Mantener la transparencia y la auditabilidad.
• Ayudábamos a los analistas y desarrolladores que necesitaban un acceso rápido.
• Y todo ello bajo unos plazos de trabajo muy ajustados.

As Asif explains in the episode, becoming a data-driven organization means internal access expands rapidly. The more teams rely on analytics, the more complex permissions become.
And that’s where many organizations hit a wall. Security becomes manual, permissions become fragile, and compliance becomes reactive. That’s not operationalized security. That’s a house of cards.

Designing Security into the Architecture from Day One 

Una de las partes más interesantes del episodio es cómo abordó monday.com el problema desde el punto de vista arquitectónico. En lugar de adaptar el sistema a posteriori para cumplir con la normativa, creó:

• Un almacén de datos europeo específico.
• Controles de acceso claros basados en roles.
• Modelos de permisos muy detallados.
• Capas de gobernanza automatizadas.

Ben describe lo que ocurre en muchas grandes organizaciones: con el tiempo, los permisos se acumulan en capas, a menudo sin una visibilidad centralizada. Al final, nadie sabe con certeza quién puede acceder a qué. Poner en práctica la seguridad significa evitar esa deriva. Significa crear sistemas en los que el control se adapte automáticamente a medida que crece el uso.

La automatización es el multiplicador de fuerzas

If there’s one theme that runs through this episode, it’s automation. Instead of treating permissions as tickets and manual updates, monday.com wrapped their infrastructure in code. Databases, roles, and access policies could be created and modified programmatically.
The result? A compliant, scalable environment stood up in less than two weeks. That’s not luck. That’s architecture. And it’s a powerful reminder that security doesn’t slow you down when it’s built correctly. It enables speed.

Qué significa realmente poner en práctica la seguridad de los datos

“Operationalizing” gets used a lot. In this episode, it’s defined as:

• Visibilidad constante de los datos confidenciales.
• Gestión centralizada y automatizada de permisos.
• Seguimiento de accesos.
• Integración con herramientas de colaboración.
• Políticas que se adaptan a medida que crecen los usuarios y los datos.

Static controls don’t scale. Manual workflows don’t scale. Security must become dynamic – part of the operating fabric of the organization. And that shift is where many enterprises struggle today.

Mira el episodio completo de STRIVE

In the discussion, you’ll hear more about:

• Cómo estructuró monday.com su almacén de datos europeo.
• Las principales lecciones aprendidas durante la implementación rápida.
• Por qué la automatización era imprescindible.
• Lo que las empresas suelen subestimar sobre la proliferación de permisos.
• Cómo plantearse la puesta en práctica de la gobernanza antes de que se amplíen las iniciativas de IA.

Ver ahora.

FAQs 

Q: How can small teams implement scalable data security?

A: Start with a clear permissions model and infrastructure-as-code tools. Automate permission management early to help avoid manual bottlenecks as you grow.

Q: What role does automation play in compliance?

A: Automation helps enable consistency, reduce errors, and simplify audits. Using APIs and scripts, you can monitor and adjust permissions dynamically.

Q: How long does it typically take to set up a compliant, scalable data environment?

A: With the right planning and tools, organizations like monday.com have achieved this in less than two weeks. Speed depends on scope and existing infrastructure.

Q: What are best practices for operationalizing data security?

A: Implement role-based access controls, automate permission management, monitor access logs regularly, and integrate security tools with collaboration platforms for real-time oversight.

Chris Mierzwa es director sénior de marketing de cartera en Commvault.

Puntos Clave

• Compliance frameworks codify lessons learned from real-world failures and help organizations strengthen resilience, governance, and operational stability.
• Organizations that approach compliance as a trust-building initiative can help strengthen customer confidence, partner relationships, and brand credibility.
• Regulatory alignment and strong risk controls can help improve insurance outcomes by demonstrating a mature and resilient security posture.
• Mapping compliance requirements to measurable business outcomes enables organizations to connect resilience investments directly to revenue protection and continuity.
• Cyber resilience capabilities such as immutable backups, rapid recovery, and governance frameworks help organizations turn compliance into a competitive advantage.

In boardrooms across Europe and beyond, compliance has become a loaded word. It conjures images of endless documentation, mounting regulatory pressure, and the looming threat of fines.
GDPR. NIS2. DORA. The acronyms keep coming, and for many organizations, it can feel like they are choking on regulation.
But what if we’ve been looking at compliance the wrong way? What if compliance isn’t just about avoiding penalties – but about building a better, stronger, more resilient business?

The Insurance Analogy: Rules That Exist for a Reason

Taquí’s a useful parallel between compliance and insurance.
When you insure your car, the insurer sets certain conditions. Your brakes must work. Your tires shouldn’t be bald. An alarm system might be required. You can argue about the inconvenience, or the cost – but fundamentally, those rules exist because they help reduce risk. They help make accidents less likely. They help protect both you and others.
And aquí’s the key point: Those requirements are usually a good idea, whether you buy the insurance or not.
Regulation works in much the same way. Governments and regulators don’t create frameworks because they enjoy it. Regulations are responses to real-world failures – data breaches, operational disruptions, systemic risk. They codify lessons learned the hard way.
You may object to the burden. You may find it frustrating. But when you look closely at what these frameworks require, it’s hard to argue that the core principles are unsound.

• Protect customer data.
• Enable operational resilience.
• Know your supply chain risk.
• Be able to recover from cyber incidents.
• Demonstrate governance and accountability.

None of that is a bad idea.

From Avoiding Fines to Enabling Trust

Too often, compliance is framed defensively: “Do this so you don’t get fined.” “Do this so you don’t go to jail.”

That’s a low bar. And it’s a missed opportunity. When we shift the perspective, compliance becomes something much more powerful. It becomes a driver of trust.
Take GDPR as an example. At its heart, it’s about protecting personal data. If your organization implements strong data protection practices – not just to tick a box, but because your systems genuinely safeguard customer information – that builds trust. Customers are more confident doing business with you. Partners are more willing to integrate with you. Regulators view you as lower risk.
Trust is not a regulatory outcome. It’s a commercial advantage.
The same applies to the Digital Operational Resilience Act. It’s not just about reporting incidents; it’s about being able to withstand and recover from disruption. In a world waquí cyberattacks are inevitable, resilience is not optional. It’s foundational to continuity, reputation, and long-term value.
When compliance drives resilience, resilience drives business stability – and stability drives growth.

Regulation and Insurance: A Feedback Loop

Taquí’s also a natural alignment between regulation and insurance markets. When regulators mandate certain standards, insurers quickly follow. Organizations that demonstrate compliance and strong risk controls are more attractive to underwriters. They may benefit from better terms, broader coverage, or more favorable premiums.
This creates a reinforcing cycle:

• Regulation sets minimum standards.
• Organizations strengthen their controls.
• Insurers reward stronger risk postures.
• Markets become more stable and resilient.

Compliance, in this context, becomes a signal to the market: We take risk seriously.

The Missing Link: Mapping Compliance to Business Outcomes

One of the most important opportunities for organizations – particularly technology providers – is to make the “line of sight” between compliance and business value explicit.
For example:

• If a product creates immutable backups, that helps support regulatory requirements around data integrity.
• If it enables rapid recovery from cyber incidents, that helps align with operational resilience mandates.
• If it provides clear audit trails and reporting, that helps support governance and oversight requirements.

But it shouldn’t stop taquí. The next step is to articulate the business benefit:

• Immutable backups help reduce the impact of ransomware – and protect revenue.
• Faster recovery helps minimize downtime – and preserves customer confidence.
• Strong governance helps reduce regulatory scrutiny – and enhances brand credibility.

This mapping is critical. Compliance is not the end goal; it’s the mechanism that enables the outcomes that businesses care about: continuity, reputation, customer trust, and competitive differentiation.

Compliance as Innovation, Not Obligation

Taquí’s a tendency to treat compliance as a “get-it-done” exercise. A cost center. A necessary evil.
But if we look at history, many best practices that are now considered fundamental to modern IT and security originated in regulatory or insurance requirements. Over time, they became embedded in how well-run organizations operate.
Encryption. Access controls. Incident response planning. Business continuity testing. Third-party risk management.
At one time, these may have been viewed as regulatory burdens. Today, they are table stakes for any serious enterprise.
The organizations that treat compliance as an innovation catalyst – rather than a checkbox exercise – are often the ones that pull ahead. They embed resilience into their architecture. They design with governance in mind. They turn regulatory requirements into product capabilities and customer value propositions.

Cyber Resilience: Waquí Compliance and Strategy Converge

This is waquí cyber resilience becomes central.
Modern regulations increasingly recognize a simple truth: Prevention is not enough. Incidents will happen. The differentiator is how well an organization can respond and recover.
Cyber resilience – the ability to withstand, recover from, and adapt to cyber disruption – is no longer just a security concern. It’s a strategic imperative. It supports regulatory compliance, yes. But more importantly, it underpins operational continuity and business confidence.
When organizations invest in resilient architectures, immutable data, rapid recovery capabilities, and robust governance frameworks, they are not merely satisfying regulators. They are building durable enterprises.

A Different Conversation About Compliance

Perhaps it’s time to change the narrative.
Instead of asking, “What’s the minimum we need to do to comply?” we should be asking:

• How does this regulation make us stronger?
• What good practice is being codified aquí?
• How can we use this to enhance trust with customers and partners?
• Waquí does this create a competitive advantage?

Compliance done well is not about fear. It’s about foresight.
It reflects lessons learned across industries. It embeds best practice into everyday operations. And when connected clearly to product capabilities and business outcomes, it becomes a powerful commercial story.
Yes, regulation can feel burdensome. Yes, the acronyms keep coming. But underneath the paperwork lies something far more valuable: a framework for running a better business.
Compliance isn’t just about avoiding penalties. It’s about enabling resilience. And resilience, ultimately, is what drives sustainable success. Learn more about how Commvault enables data protection to help your organization meet compliance requirements aquí.

Preguntas frecuentes

Q: Why should organizations view compliance as more than a regulatory obligation?

A: Compliance frameworks often reflect best practices developed in response to real-world cyber incidents, operational failures, and governance challenges. Organizations that embrace compliance strategically can help strengthen resilience, improve trust, and create long-term business value.

Q: How does compliance contribute to customer trust?

A: Strong compliance practices demonstrate that an organization takes data protection, governance, and operational continuity seriously. This can help increase customer confidence, strengthen partner relationships, and position the organization as a lower-risk business.

Q: What is the connection between compliance and cyber resilience?

A: Modern regulations increasingly focus on an organization’s ability to recover from disruptions rather than solely preventing them. Investments in resilient infrastructure, immutable backups, and rapid recovery capabilities can help organizations maintain continuity during cyber incidents.

Q: How can compliance positively impact insurance and risk management?

A: Organizations with mature compliance programs and strong security controls are often viewed more favorably by insurers. This can lead to better coverage options, improved policy terms, and potentially lower premiums.

Q: Why is it important to connect compliance initiatives to business outcomes?

A: Compliance efforts are most effective when organizations clearly demonstrate how controls support broader goals such as protecting revenue, reducing downtime, and preserving customer trust. This helps leadership view compliance as a strategic investment rather than a cost center.

Q6: How can organizations turn compliance into a competitive advantage?

A: Businesses that embed resilience, governance, and security into their products and operations can differentiate themselves in the market. By proactively aligning with regulatory expectations, organizations can strengthen their reputation and create greater confidence among customers and stakeholders.

Darren Thomson es director técnico de campo en Commvault.

Puntos Clave

• La soberanía operativa se centra en quién puede acceder a los sistemas y bajo qué jurisdicciones operan.
• El acceso de los proveedores, los flujos de telemetría y las vías de asistencia pueden generar lagunas ocultas en materia de soberanía.
• La soberanía operativa es más difícil de certificar porque requiere una visibilidad y una auditoría continuas.
• Las organizaciones deben poder demostrar y documentar todas las vías de acceso a los entornos soberanos.

Ask most organizations where their sovereignty program is strongest, and the answer is usually some version of the same two things: data locality and encryption. They know where their primary data lives. They’ve implemented bring-your-own-key or hold-your-own-key arrangements. They can point to certifications.

Ask them who accessed their sovereign environment in the last ninety days, from which countries, and under which legal jurisdictions – and the confidence tends to evaporate.

Operational sovereignty is the hardest pillar to audit, the most likely to be underestimated, and the most common place where a sovereignty posture that looks solid on paper breaks down in practice. The Informe sobre la Readiness para la soberanía digital names it as one of the four pillars – this post goes further.

The question most organizations can’t answer: ‘Who accessed your sovereign environment in the last 90 days, from which countries, and under which legal jurisdictions?’

Qué significa realmente la soberanía operativa

Operational sovereignty is not about where data lives. It’s about who runs the environment – and who can reach it. It covers three things that most sovereignty programs treat as implementation details rather than first-class concerns:

• Personnel access and jurisdiction. Every person who can access your sovereign environment – for support, maintenance, monitoring, or incident response – operates under a defined legal jurisdiction. If a support engineer in a country subject to a foreign data access law can reach your systems, the sovereignty of your infrastructure is only as strong as that engineer’s legal exposure.

Most organizations, when they audit this for the first time, find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.

• Third-party and vendor access. Your sovereignty boundary extends to every vendor, managed service provider, and software platform with access to your sovereign environment. ITSM platforms, monitoring tools, SIEM systems – if these sit outside your sovereignty boundary but have access to data or metadata within it, you have a gap that data locality controls cannot close.
• Telemetry, billing, and control-plane traffic. Data sovereignty programs focus on primary data. Operational sovereignty requires mapping where everything else goes: the telemetry your infrastructure generates, the metadata your monitoring systems collect, the billing data your provider processes. These flows can cross jurisdiction boundaries even when primary data doesn’t – and they are rarely mapped.

Why This Pillar Is Harder To Certify – and Why That Matters

Data locality is relatively straightforward to document. You can point to a storage region, a data residency agreement, a third-party audit. Operational sovereignty doesn’t have the same paper trail. There is no certification that guarantees the jurisdictional status of every support engineer who might access your environment.

This is precisely what makes it both the hardest pillar to audit and the most important to get right. It also connects directly to the minimum viable sovereignty challenge: applying the right operational controls to the right workloads requires knowing what those controls are – and operational sovereignty is where that knowledge is most commonly absent.

La dimensión de la cadena de suministro

La NIS2, que amplía las obligaciones en materia de ciberseguridad a los sectores de la energía, el transporte, la sanidad y las infraestructuras digitales, exige ahora a las organizaciones que evalúen las prácticas de ciberseguridad de sus proveedores de tecnología. Para los programas de soberanía, esto tiene una consecuencia directa: la postura de soberanía de los proveedores ya no es un simple detalle en la contratación pública. Es un requisito que se puede auditar.

Esto implica plantear nuevas preguntas a cada proveedor que se encuentre dentro de su perímetro de soberanía: ¿Dónde se encuentra su personal de soporte? ¿Bajo qué jurisdicción legal operan? ¿Qué ocurre con el acceso que tienen a mi entorno si su empresa es adquirida por una entidad no perteneciente a la UE?

Cómo es lo bueno

Un entorno operativamente soberano tiene cuatro características que se pueden demostrar, no solo documentar:

• Every access pathway into the sovereign environment is mapped – not just primary access, but vendor access, support access, and monitoring system access.
• El estatus jurisdiccional de cada persona o sistema que tiene ese acceso se documenta y se audita con una periodicidad definida.
• Se hace un inventario de los flujos de tráfico de telemetría, metadatos y del plano de control, y estos se mantienen dentro de los límites de soberanía o se evalúan y aceptan explícitamente como fuera del ámbito de aplicación.
• The organization can answer the ninety-day access question – precisely, with evidence.

One more thing: Operational sovereignty doesn’t end at access control. If recovery requires personnel who operate outside your sovereignty boundary, the posture fails at the moment of an incident. That’s the subject of the fourth post in this series. ElInforme sobre la Readiness para la soberanía digitaldigital incluye una pregunta de evaluación directa sobre la soberanía operativa.

Preguntas frecuentes

P: ¿Qué es la soberanía operativa?

R: La soberanía operativa se refiere a quién gestiona y tiene acceso a un entorno, incluyendo al personal, a los proveedores y a los sistemas de soporte. Va más allá del lugar donde se almacenan los datos.

P: ¿Por qué se suele pasar por alto la soberanía operativa?

R: Muchas organizaciones se centran principalmente en la ubicación y el cifrado de los datos. A menudo, las vías de acceso, el personal de soporte y los flujos de telemetría no se auditan a fondo.

P: ¿Cómo influyen los proveedores en la postura en materia de soberanía?

R: Los proveedores y los proveedores de servicios gestionados pueden tener acceso a sistemas sensibles o a metadatos. Sus jurisdicciones legales y prácticas operativas pueden afectar al cumplimiento general de las normas de soberanía.

P: ¿Por qué son importantes la telemetría y los metadatos?

R: Aunque los datos primarios se queden en el ámbito local, la telemetría y los metadatos pueden traspasar las fronteras jurisdiccionales. Estos flujos pueden suponer riesgos de cumplimiento normativo si no se gestionan adecuadamente.

P: ¿Qué incluye un modelo sólido de soberanía operativa?

R: Incluye rutas de acceso definidas, controles jurisdiccionales documentados, acceso de proveedores auditado y visibilidad de todos los flujos de telemetría y metadatos.

Alex Zinin es vicepresidente y director general del área de Proveedores de Servicios Gestionados en Commvault.

Puntos Clave

• Las arquitecturas soberanas suelen dar prioridad a las auditorías y los controles de acceso frente a la preparación para la recuperación.
• El personal de recuperación, backup y los modelos de custodia clave pueden generar lagunas en la soberanía durante los incidentes.
• Es fundamental que los controles sean uniformes tanto en el entorno principal como en el de recuperación.
• Para lograr una resiliencia preparada para la soberanía, se necesitan procedimientos de recuperación probados en condiciones reales.

Picture the moment. The attack has already happened. The incident response team is assembling. Someone must decide which systems come back first, in what order, using the correct recovery points.

And then someone realizes: The personnel with recovery system access are based in a different country. Worse, the recovery environment itself (hosted in a cloud region, a partner datacenter, or a secondary site) was never subject to the same sovereignty controls as the primary data.

The practice wasn’t subject to the same sovereignty controls as the primary data. The regulator is asking for status. The clock is running.

This is the scenario most sovereign architectures were not designed for – and the one the Informe sobre la Readiness para la soberanía digital calls out directly: most sovereign applications are designed for the audit, not the incident.

Most sovereign applications are designed for the audit, not the incident. The difference becomes visible at the worst possible moment.

El punto ciego de la recuperación en la arquitectura soberana

Sovereignty programs are built around access control – who can reach the data, under what authority, through what pathway. That architecture is necessary. It is not sufficient. And it connects directly to the operational sovereignty gaps analizadas en la tercera entrada de esta serie: If the people who run your environment operate outside your sovereignty boundary, that problem doesn’t disappear during an incident. It becomes the problem.

What access control leaves unanswered is the harder question: What happens after an incident, when recovery is not just a technical operation but a legally constrained one?

A ransomware attack on a regulated European organization doesn’t simply create a recovery problem. It creates a recovery problem that must be solved within a jurisdiction, using personnel with appropriate authorizations, against recovery points that can be demonstrated to be clean and uncompromised.

The sovereign architecture designed to protect the data can make recovery harder if resilience wasn’t built into the original design.

Los modos de fallo específicos

The ways sovereign recovery architectures fail are predictable – and common:

• Personal de recuperación fuera de los límites de la soberanía. Los ingenieros que conocen los sistemas de Recovery pueden trabajar en otra jurisdicción. Bajo presión, recurrir a ellos es la opción más fácil. Además, supone una violación de la soberanía justo en el momento menos oportuno.
• Backup infrastructure without matching controls. Primary sovereign environments are carefully controlled. Backup infrastructure – particularly older or secondary environments – is frequently not subject to the same sovereignty requirements. If recovery points are stored or processed outside the boundary, compliant recovery is not available from compliant infrastructure.
• Key custody under crisis conditions. Hold-your-own-key arrangements are designed for normal operations. Under crisis conditions – with primary systems compromised and time pressure acute – the key custody model that works in a routine maintenance window may become an obstacle to recovery. If this hasn’t been tested, it’s an assumption, not a control.
• Cross-environment governance gaps. Organizations operating across multiple sovereign tiers – which is most of them – often have strong controls in primary environments and weaker controls in secondary environments that are also part of the recovery path. Consistency across the full estate is what auditors will look for. Gaps in secondary environments become visible exactly when consistency matters most.

Por qué los controles de soberanía pueden complicar la recuperación

The same controls that make a sovereign environment defensible to an auditor can make it harder to recover from. Data movement restrictions that prevent unauthorized exfiltration also constrain recovery orchestration. Key custody arrangements that ensure no provider can access your data without authorization also add friction when you need to restore quickly.

None of this means these controls are wrong. It means they have to be designed with recovery in mind from the start – not added to an architecture where recovery was an afterthought. This is the core of the minimum viable sovereignty principle: Calibrating controls to actual requirements includes recovery requirements, not just access control requirements.

Lo que requiere una resiliencia preparada para la soberanía

• Clean recovery validation. Proving that recovery points are free from compromise before restoring to production – not just recent, but uncompromised. In a ransomware scenario, a recent backup may itself be compromised. The ability to identify and restore from a known-clean recovery point, validated before it’s needed, is a sovereignty requirement, not just a disaster recovery requirement.
• Cross-environment governance. Consistent sovereignty controls and audit evidence across the full estate – not just the primary sovereign deployment. Every environment in the recovery path must meet the same requirements as the primary environment.
• Tested under realistic conditions. Regular exercises that validate recovery under the conditions that will actually exist during an incident: the legal constraints that apply, the personnel who are available, the recovery points that are clean. An annual disaster recovery test that doesn’t account for sovereignty constraints is not a sovereignty-ready exercise.

La pregunta que debes añadir a tu análisis sobre la soberanía

There is a direct way to assess whether your recovery architecture meets the same sovereignty requirements as your primary data environment: Ask it as a question and require an honest answer.

Can you recover your sovereign data, cleanly, within defined tolerances, using personnel operating within your sovereignty boundary, right now – under real conditions, not a controlled exercise?

For most organizations, the honest answer reveals a gap. The organizations that find it now – before the incident – will be best prepared with evidence when the regulator asks for it. The ones that don’t will be building it under pressure, in front of the people they least want to disappoint.

The Informe sobre la Readiness para la soberanía digitalincluye una pregunta sobre la evaluación de la arquitectura de recuperación directa.

Preguntas frecuentes

P: ¿Por qué es importante la recuperación para la soberanía digital?

R: La soberanía no es plena si las organizaciones no pueden recuperar los datos dentro de los mismos límites legales y operativos que se utilizan para protegerlos.

P: ¿Cuáles son los fallos más habituales en la Recovery de la soberanía?

R: Entre los fallos más habituales se encuentran que el personal de recuperación trabaje fuera de los límites de la soberanía, que backup carezca de los controles adecuados y que la gobernanza no sea coherente en todos los entornos.

P: ¿Cómo puede la custodia de las llaves complicar la Recovery?

R: Los modelos en los que tú mismo gestionas tu clave refuerzan la seguridad durante el funcionamiento normal, pero pueden ralentizar las tareas de recuperación en caso de incidentes si no se prueban adecuadamente.

P: ¿Qué es la validación de una recuperación limpia?

R: La validación de la recuperación limpia confirma que los puntos de recuperación no se han visto comprometidos antes de restaurar los sistemas. Esto es especialmente importante en casos de ransomware.

P: ¿Cómo deberían las organizaciones poner a prueba su resiliencia de cara a la soberanía?

A: They should conduct realistic exercises that account for legal constraints, operational availability, and validated recovery points – not just standard disaster recovery testing.

Alex Zinin es vicepresidente y director general del área de Proveedores de Servicios Gestionados en Commvault.