How do we keep the UK’s Critical National Infrastructure secure, resilient and trusted – especially in today’s volatile digital world? And as cyber threats rise and technology evolves, how can organisations retain sovereign control while still embracing global innovations?
In this episode of Talking Transformation, Adrian Chiffi is joined by Matt Reid to explore why SovereignOps is no longer a “nice to have”, but a fundamental approach for protecting UK Critical National Infrastructure and essential services – from healthcare and transport, to defence and beyond.
We unpack why sovereignty goes far beyond where servers sit. It’s about legal control, operational governance, trusted people, and resilient digital platforms.
Matt shares how CGI’s SovereignOps approach in particular is helping organisations reduce risk, improve service continuity and data control, and prepare for the future. From investing in UK-based talent and digital hubs, to embedding AI-powered observability and automation throughout, we delve into how we’re building secure, agile, and future-ready operations here in the UK, whilst using our experience as a global innovator.
Whether you're responding to evolving threats or planning for long-term resilience, this episode offers practical insight on how to protect what matters most. We discuss:
- Why SovereignOps is more than data location – it’s about people, governance and operational control
- The rising importance of data sovereignty, residency and legal compliance
- How UK-based teams, skills investment and local operations reduce risk
- The role of AIOps and observability in strengthening resilience
- Why balancing sovereign control with global innovation enables long-term success.
Podcast speakers:
- Adrian Chiffi – Senior Vice President, GTO UK business unit leader, CGI
- Matt Reid – Vice President, GTO UK enterprise IT leader, CGI
- Transcript
-
Adrian Chiffi: In an increasing and digital volatile world, how do we keep the UK's most critical services secure, resilient and trusted? Is data sovereignty now as important as physical sovereignty when it comes to protecting national interests? And as technology advances, how do we strike that right balance between maintaining sovereign control, data residency and access to that global innovation.
Hello everybody, I'm Ade Chiffi and I lead Global Technology Operations for CGI in the UK.
In today's episode of Talking Transformation, we're going to be really focusing in on all things sovereign operations. You know that topic that's absolutely critical to resilient security and the future readiness of the UK's critical national infrastructure.
Delighted today to be joined by Matt Reid, who leads Enterprise IT for CGI in the UK and right at the heart of supporting our clients in these really vital areas.
Hello Matt, great to have you on.
Matt Reid: Hi Ade. Yeah, it's great to be on; really enjoying these transformation series so, really, really good to be part of it.
Adrian: You're a good man. I've been trying to get him for a little while. So great. We’ll have a great conversation Matt. Let's get straight into it, OK?
When we think about the sectors that make up the UK's critical national infrastructure? So healthcare, transport, energy, higher education, defence it's clear that they're the lifeblood of how the nation runs.
So, how do you see sovereign operations specifically support in the resilience and in essence, the continuity of these of these essential services. What’s your take, Matt.
Matt: Yes, It's a great point Ade, you know, the sectors you mentioned and many other sectors absolutely fundamental to daily life. You know, they keep [the] country moving and healthy, and pointing in the right direction. And we're seeing sovereign operations play a significant role because they don't only ensure that the critical data, but also those systems underpinning the data are protected. But they're also available and they're within their national borders, but also governed by UK law.
So, you know, it's not only about compliance, it's about ensuring that in, times of crisis, whether that be cyber-attacks or, you know, geopolitical tensions, which are clearly on the rise, UK can maintain full control over the services that the people really rely on.
So, we're, you know, we're focusing in on data sovereignty, residency and resilience as usual, but we're also helping these industries safeguard the continuity of the services that, you know, the nation actually really rely on.
Adrian: Absolutely, Matt, you particularly talked about cyber-attacks there, and if we think about across the market, you know, we've seen a huge rise in cyber threats against CNI in in recent years and national agencies like the NCSC are really warning the stakes are higher than ever.
You know, Matt, when you're thinking about working with organisations on the ground, what's the biggest shift that you've seen then in how we think about data sovereignty, that data residency and really importantly that operational resilience?
Matt: Yeah, absolutely Ade. You know, we're seeing a big shift by organisations now that are no longer seeing sovereignty and residency as ‘nice to have’. So yeah, absolutely becoming fundamental to their operation in terms of safeguarding the services that they also provide.
There's a real recognition now that if you don't have control over where the data is stored, and more importantly, managed, then you leave yourself exposed to risks. Particularly with cyber threats becoming more and more complex.
Maintaining the data within UK jurisdiction and the UK law is critical to safeguarding the national infrastructure.
Adrian: Let me take that one step further, Matt. You know, one thing that stands out for me is, you know, sovereign operations aren't just about, let's say, where the servers sit, for example, it's about that governance, the people managing the systems and the operational models that underpin them.
Matt, how important is that human factor then? So, I know you've been focused in on local skills, local control. You know, when you're truly developing sovereign IT operations, you know, give me a little bit about the people factor then.
Matt: Yes, it's absolutely critical Ade. You can have all the correct set up technically and from a data management perspective but if you're operational management sits outside of the UK legal frameworks, then you're still carrying that risk.
So, at CGI we, you know, we make sure both the infrastructure and the operational teams are UK based, people are UK security vetted and, more importantly, subject to those UK regulations.
With this approach we massively reduce vulnerabilities and ensure compliance. And by continuing to invest in local talent, we're building the skills needed to keep our platforms resilient, available, but more importantly, future proofed.
We've seen significant rise in vulnerabilities and they're growing year-on-year. So it's really important that our client services are protected. This is why we continue to invest in services like our vulnerability management and remediation services to protect us, our clients and the UK.
Adrian: It is critical, Matt, I've seen it first-hand, the way that you're working with the team, working with our clients in that space.
You particularly mentioned talent there. You know, it's something that I know we feel really strongly about. You know, building those skills-pipelines and partnering with universities and then creating those local digital hubs can you can you share a bit about how you're helping clients, not just secure today's operations, but also, you know, via the talent you're bringing in, prepare for the future as well.
What's your take on that?
Matt: You know, within CGI we've got a very mature career progression path.
Developing that future talent from our, you know, five star service desk, but also through initiatives such as our new Digital Command Centre in Wales and through, like you mentioned, close partnerships with leading UK universities.
So, we've got a really, really strong pipeline of skilled professionals, but very importantly, it's not just on the technology side, they're also aware and tuned in to the legal compliance and operational requirements that come with sovereign operations.
So, it's about ensuring that we have the capability to continue to innovate, but also protect at the same time.
So we're keeping the UK's critical services safe, resilient, available, but also prepared for whatever comes next.
Adrian: And that's the key point there, Matt, isn't it? It’s, you know, it's that future proofing constantly looking-out there and, you know, with that in mind, you know, we've seen technology like AI Ops for example, you know, really becoming central to maintaining resilience. So those predictive analytics, proactive monitoring, you know, they really are changing the way our teams are working.
So, Matt, what role do you see technology like AI Ops and observability playing in strengthening the UK's critical national infrastructure over the next few years? Where are you on that?
Matt: Yeah. It's a great question. So, AI Ops is a is a real game changer for us, Ade, you know the pace of change within this platform is significant. More and more capability day-on-day. This allows organisations to predict and prevent issues rather than simply reacting when things go wrong.
So, what that means is it helps minimise downtime but also improves our user experience across the board. So if they, you know, if their services are up and running effectively and optimally then, you know, the users are happy, service is thriving.
So when it comes to critical national infrastructure resilience isn't just a ‘nice to have’, it's absolutely vital to the organisation’s operation. So that real time, visibility, automation and predictive insights means that issues can be spotted really early in the process, reducing the risk of disruption.
On top of this, we've also got, you know, full stack observability; absolutely critical. So, not just at that infrastructure level, but right through the applications and workflows in a unified approach to enterprise IT.
Adrian: And that's the key, isn't it? Making sure there's that join-up there for full visibility.
Matt: Absolutely, end to end accountability. And this is helping organisations maintain, you know, the end to end operational awareness, availability and integrity.
And, as you mentioned, we have AI Ops right at the heart of our organisation, powering our sovereign Ops approach. And, due to the significant levels of automation and AI within our platform Ade, we can offer UK hosted - be that on prem or through our sovereign cloud or even a hybrid approach, driving that sovereign service with efficiency built in.
Adrian: And that efficiency is key, Matt, isn't it?
I love that, you know, it's about creating operations that are intelligent, agile and, you know, one of the things I've really seen come through from you and the team there, that self-healing as well. So, Matt, fantastic.
If I attempt to summarise now, couple of takeaways from our from our conversation, Matt please, as I know you will, jump-in if there's anything I've missed.
So, what I've heard then sovereignty is about more than geography, it's about governance, security, it's about people. Data sovereignty and data residency they have to go hand-in-hand, so ensuring both control and compliance I've heard there, as we've been going.
Also, balancing sovereign control with access to global innovation, now that's crucial for staying competitive and making sure that we are getting, and the organisations that we support are getting that goodness from that global muscle and then investing in local talent that's essential for sustainable resiliency and that long term and future proofing.
And my last point, Matt, I'll bring you on after this. Proactive technologies like AI Ops, you know, [are] really reshaping how we manage and protect that critical national infrastructure, importantly, in real time, you know, that's the critical point there.
Matt, you know final thoughts from you for, you know, on that and for organisations who are listening, thinking about how they may strengthen their sovereign operations, what's your take?
Matt: Yeah, I think the people side of it, but also that innovation that you mentioned, you have to keep moving as an organisation, but moving securely and safely, because when you do it right, you know, they provide a secure foundation for that innovation but you continue to be agile with that built in long term resilience.
So, the future, you know, will belong to organisations who can protect their critical operations while still embracing the those possibilities of global technology. And, Ade sovereign Ops really helps create that balance.
Adrian: I couldn't agree more. I couldn't agree more. And listen, Matt, thank you. It's been a brilliant conversation and, I have to say, an absolute pleasure having you on. So, thank you so much.
Matt: Yeah, I've enjoyed it Ade.
Adrian: Good man. Good, good man.
Now, if you're listening, and want to explore these ideas further. Please feel free to reach out to either Matt or I on LinkedIn or visit CGI’s website to learn more about our Sovereign Ops offering.
And, as always, you can find this and other Talking Transformation podcasts wherever you access them.
Thanks again for tuning in. Have a great rest of the day.
[END OF AUDIO]
Listen now to explore how SovereignOps is key for secure, UK-hosted IT operations, and to learn more:
Discover our SovereignOps offering
Read our blog: How SovereignOps is securing the future of the UK’s Critical National Infrastructure
Previously on the Talking Transformation podcast
Episode 4 explores our end-to-end approach for digital transformation success – the Digital Backbone
