Digital Sovereignty and Resilience: Key Advice for CIOs on Dependencies and Testing

Digital sovereignty and digital resilience come down to two things: knowing your dependencies and testing your controls. In this STRIVE clip, SMAL's Dirk Deridder and Commvault's Mark Molyneux give CIOs practical advice on building digital autonomy. Ruben Renders of Commvault joins the conversation. You will hear why a risk-based approach to dependencies beats chasing sovereignty for its own sake, and why regular testing is how you find your gaps. TL;DR: Map your dependencies, focus on the critical ones, and test your controls until they become routine. “Once you’ve identified your control, test it. Test and test and test because that’s where you’re going to reveal your gaps.” -- Mark Molyneux Key takeaways * IT has been the backbone of critical services for more than half a century -- if it fails, society’s functioning stops with it * Resilience means recreating the entire environment, not just recovering data -- certificates, endpoint identification, firewall rules, trust relationships, and encryption keys all count * Take a risk-based approach to sovereignty -- inventory your dependencies and decide where you need more autonomy or an exit strategy * Look for small single points of failure -- a DNS server dependency can leave you stuck * Think about lock-in for identity and access management -- you will not swap it out in a day * Test data moves between providers on a regular cadence, including when key people are out of the office Who is this for? * CIOs: Set a risk-based strategy for dependencies, autonomy, and exit planning * CISOs: Pressure-test the trust relationships, keys, and certificates your recovery depends on * CTOs and enterprise architects: Weigh lock-in when you make architectural choices, especially for identity and access management * IT operations and infrastructure leaders: Build testing of provider moves and recovery into your regular cadence * Public sector and critical services leaders: Plan for the societal impact of IT failure Speakers * Dirk Deridder -- CTO, Smals * Ruben Renders -- Commvault * Mark Molyneux -- Commvault Resources * Full episode: https://youtu.be/V-91h04wc5U * Guide to Digital Sovereignty for Risk Teams: https://www.readiverse.com/resources/whitepaper/digital-sovereignty-from-policy-to-practice FAQ Q: What is the difference between digital sovereignty and digital resilience? A: Sovereignty is about how autonomous you are. Resilience is about whether you can recreate your entire environment if your systems are gone. Deridder says to know your dependencies rather than target sovereignty for its own sake. Q: What does recovering an entire environment involve? A: It goes beyond recovering data from a database. You also need certificates, endpoint identification, firewall rules, and the trust relationships and encryption keys across your ecosystem. Q: What is a single point of failure in digital sovereignty planning? A: It is a small component you forget about, such as a DNS server dependency. It can leave you stuck if a sovereignty disaster strikes. Q: Why should CIOs think carefully about identity and access management? A:It creates lock-in that is hard to reverse. Deridder says it is not something you will swap out in a day, so plan for it upfront. Q: How often should you test your controls? A: Molyneux says to test regularly, until it becomes part of your cadence. Test moves between providers and test when a particular person is out of the office. #DigitalResilience #DigitalSovereignty #CIO #ResOps #CyberResilience