Digital Sovereignty vs. Resilience: What Comes First?

Digital sovereignty or digital resilience -- which comes first? In this STRIVE episode, Dirk Deridder (CTO, SMALS), Mark Molyneux (CTO North Europe, Commvault), and host Ruben Renders (Solutions Director, Commvault) explain why resilience is the real objective and how ResOps gives you an operating model to reach it. You will learn how to map dependencies, reduce vendor lock-in, and recover your entire ecosystem after a cyberattack, outage, or geopolitical shock. Chapters 00:28 Introductions 02:47 The Role of IT in Public Sector 05:45 Sovereignty and Its Implications 10:50 Technological Challenges in Resilience 15:56 Operational Resiliency and Cybersecurity 20:40 Dependency Mapping and Business Continuity 23:35 Navigating Cloud Native Applications and Lock-In Risks 25:06 The Importance of Open Standards in Cloud Computing 27:25 Balancing Sovereignty and Digital Innovation 30:41 Risk Management in Public Sector IT 34:08 Understanding Vendor Relationships and Contracts 40:00 Resiliency Operations: Preparing for the Unexpected 43:21 Starting Your Journey: Advice for New CIOs TL;DR Sovereignty is a risk to manage. Resilience is the objective. Know your dependencies, protect the processes that keep your business alive, and test your exit and recovery paths before a crisis forces you to. "Sovereignty is not a destination. It's an operating capability." -- Mark Molyneux, CTO North Europe, Commvault Resource: * Guide to Digital Sovereignty for Risk Teams: https://www.readiverse.com/resources/whitepaper/digital-sovereignty-from-policy-to-practice Meet the Guests - Dirk Deridder -- CTO and executive committee member at SMALS, a Belgian ICT service provider that hosts applications exclusively for the public sector - Mark Molyneux -- CTO North Europe at Commvault - Ruben Renders -- Solutions Director at Commvault, spearheading Commvault's sovereign strategies Key Takeaways - Make resilience the objective -- know your sovereignty dependencies, but focus on recovering from any cause, whether sovereignty, hacking, or human error - Choose autonomy over ideology -- keep the freedom to make your own technology choices and deliver your own roadmap - Recover the whole ecosystem -- rebuild data, certificates, endpoint identification, firewall rules, and trust relationships, not only databases - Set a portability time objective -- measure how fast you can swap a platform or component when a sovereignty issue appears - Measure cyber recovery differently -- use a mean time to clean recovery objective rather than relying on RTO alone - Map your dependencies -- build a risk-based inventory that catches small single points of failure, such as DNS and identity and access management lock-in - Define your minimum viable company -- protect the critical processes first, because not everything needs to be sovereign - Match sovereignty to your risk appetite -- every extra copy, server, and sovereign alternative has a cost - Secure exit rights in contracts -- negotiate legally binding terms with clear exit periods, such as 12 or 24 months - Test, test, and test again -- exercise your controls before a crisis exposes the gaps Who Is This For? - CIOs and CTOs -- set a risk-based sovereignty and autonomy strategy without sacrificing innovation - CISOs -- extend cyber resilience planning to the full ecosystem, including third-party dependencies - Chief risk and compliance officers -- align sovereignty decisions with risk appetite and contract law - IT infrastructure and operations leaders -- plan portability, recovery, and exit strategies - Enterprise architects -- balance vendor lock-in against the value of integrated cloud services - Public sector IT leaders -- protect critical citizen services that run for 15 to 30 years or more - Business continuity and resilience leads -- define the minimum viable company and test it FAQ Does a fully sovereign stack make you more resilient? Not necessarily. Dirk explains that building your own independent stack gives you more control only over the alternative you built. Much of resilience comes from a global market where multiple vendors can serve you when one fails. What is a portability time objective? It measures how quickly you can port an application or swap out a component when a sovereignty issue appears. The episode explores why technical gravity makes this slow today, and why it is a vision worth working toward. What is ResOps? ResOps treats resilience as an active operating model, not a passive backup plan. In this episode, the guests explain why sovereignty fits inside resilient operations, alongside cyber incidents, outages, and data center loss. What is a minimum viable company? It is the smallest set of people, systems, and processes you need to keep operating and keep revenue flowing. Dirk suggests starting with the workplace basics then identifying the processes that would bankrupt you if they went down. #DigitalSovereignty #CyberResilience #ResOps