Heading to Gartner IT Symposium: the three questions I'm bringing

Every conversation I have with a regulated customer ends up in one of three places. Next week I am at Gartner IT Symposium/Xpo in Orlando, and I am bringing those three with me. I would rather test them against what other people are seeing than against my own notes.

Each one comes from a write-up I have already published, so this post is a map, not a new argument.

1. Where should the model run?

The question never starts with which model or how many GPUs. It starts with "where is this allowed to run, and what happens when we have to leave?"

The worked answer I published is a decision record for an insurer regulated in the EU and the UK, and its uncomfortable line is this: at that volume, renting the model through a managed API is the cheaper thing to run. That is still not the deciding argument. Control over where regulated data goes, and an exit you can actually take, decide it. I wrote the run-cost argument down so that nobody pretends it isn't true.

The full record is in Where should the model run?.

What I want to hear in Orlando: how other people weigh a run-cost argument against a where-can-it-run and can-we-leave argument, and who in the organisation gets to settle it.

2. What does the exit really cost?

Leaving is usually discussed as a clause. The cost is not in the clause. It is in which parts of the estate move easily and which do not.

In the composite insurer migration I published, the workloads stay virtual machines on the same operating substrate in both clouds, which is the lightest exit that design allows. What does not port is the network hub. Each cloud's routing and inspection construct belongs to that cloud, and moving between them is a network project, not a migration. The design is built from public documentation, not from any customer, and the post says what it could not confirm.

The full walk-through is in One substrate, two clouds: leaving an ESXi datacenter for NC2 on Azure and Google Cloud.

What I want to hear in Orlando: which part of an exit turned out to be the hard part for people who have actually done one. I suspect it is rarely the part on the slide.

3. Is resilience a number you can defend?

Three regimes on two continents now ask financial institutions the same thing: show us you can lose a provider and keep serving customers. DORA in the EU, the PRA's impact tolerances in the UK, and the US interagency guidance on third-party relationships each turn resilience from a claim into something you set, test and defend.

The test I would put to any CIO before the next exam is short. For your three most important business services, what is the tolerance, and when did you last measure recovery against it? If the answer is a date, good. If it is a document, that is the gap.

The full argument is in Resilience is now a regulated number. It is my reading of public regulatory material, not legal or compliance advice.

What I want to hear in Orlando: whether the people running these tests find the number helpful or find it theatre, and what they changed because a drill failed.

If you are there

If any of these three is live for you, I would like to hear how you are answering it. Find me at the event, or message me here, and tell me which question. I will write up what I hear, in my own words, after I am home.

I work on hybrid multicloud and AI infrastructure through CloudLab Works. These are my views, from my own reading and my own work.