Why the Great Virtualization Reset looks different in regulated industries

Four requirements to guide migration planning and execution

If you run IT for a law firm, health system, bank, insurer, or government agency, a virtualization decision is never only a licensing decision. Every workload comes with obligations — including knowing where the data lives, who touched it, how long you keep it, and whether all that can be proven to an auditor.

That’s why the Great Virtualization Reset feels different in regulated industries. VMware licensing changes forced a reassessment. But the harder questions sit underneath the hypervisor, in the operating model that keeps your environment compliant. HPE research found that only 5% of enterprises are fully ready for the reset, with migration risk and skills gaps among the top barriers to progress. For regulated organizations, migration risk is concrete. A poorly planned move can break an audit trail or put data somewhere it isn’t allowed to be.

What one infrastructure review revealed

We recently worked with a client in a highly regulated industry to evaluate their virtualization options and decide on the best path forward. Their experience highlights something we see across legal, healthcare, financial services, insurance, and government organizations: There is no one-size-fits-all answer.

For some organizations, continuing with VMware remains the right decision. For others, alternative platforms offer a way to align infrastructure more closely with business objectives, compliance obligations, and future modernization plans. The key is understanding what’s possible before committing to either path.

Start with obligations, not products

Our client engagement began with a review of the organization’s existing environment. We examined infrastructure investments, support requirements, cloud strategy, and long-term goals. We also looked at the regulatory commitments the environment has to uphold every day.

Instead of starting with a specific product, the team asked which approach would deliver the most value while keeping the organization compliant as it grows. That shifted the evaluation from technology features to business and regulatory outcomes.

We’ve found that the cost of maintaining the status quo deserves the same scrutiny as the cost of change. Licensing models, infrastructure requirements, and compliance expectations all keep moving. Regulated organizations benefit from periodically checking whether their current approach still fits.

The four requirements regulated organizations must address

Any virtualization path — stay, switch, or run both — must hold up against four requirements:

1. Data residency and sovereignty. Regulators and client contracts, as well as state/provincial and federal laws, increasingly dictate where data can be stored and processed. A new platform, replication target, or cloud region must respect those boundaries from the start.

2. Audit trails. Auditors want to know who provisioned, changed, moved, or deleted a workload, and when. Your management layer needs to capture that history consistently across every hypervisor you run.

3. Retention requirements. Legal holds, medical records rules, and financial recordkeeping mandates set timelines for data retention and disposal. Such policies have to survive a migration intact.

4. Chain of custody for backup and recovery. When you restore data, you need to prove it’s the same data you protected, handled only by authorized people and systems. That chain can’t break when backup tools, storage targets, or hypervisors change.

Look beyond the hypervisor

Virtualization decisions affect far more than the hypervisor. Backup and recovery, infrastructure management, automation, monitoring, and operational processes all shape whether an environment stays compliant.

As part of its evaluation, our client explored the HPE virtualization portfolio. That included HPE Morpheus VM Essentials Software, HPE Morpheus Enterprise Software, HPE OpsRamp Software, and HPE Zerto Software. The client also considered HPE ProLiant Compute servers and HPE Alletra Storage MP. The team assessed how these technologies would integrate with existing investments and third-party data protection platforms, such as Veeam and Commvault.

For a regulated organization, that integration question matters as much as performance. Your backup, retention, and audit processes are often built around those existing tools. The lesson: Infrastructure decisions work best when you evaluate them as part of a broader operating model, not as isolated technology purchases.

Modernization doesn’t have to be disruptive

One of the biggest concerns in regulated industries is the impact on day-to-day operations and on compliance posture mid-transition.

This engagement showed that modernization can happen incrementally. You can run VMware and alternative platforms side by side and move workloads according to business priorities, change-control windows, and validation requirements. HPE Morpheus VM Essentials Software manages VMware ESXi and KVM-based virtual machines from a single console. HPE Zerto Software supports continuous data protection and data mobility when it’s time to move. It makes it possible to modernize at your own pace without forcing a large-scale cutover that puts audit readiness at risk.

Why regulated organizations work with CBTS

Choice creates opportunity, but only if you have a partner who understands both the technology and the rules it has to follow.

We work with organizations across healthcare, financial services, government, and other regulated industries. We help them design, build, and operate environments aligned with frameworks, including HIPAA, SOC 2, PCI DSS, and FedRAMP. HPE is one of our deepest technology partnerships, which gives our engineers direct access to roadmap guidance and escalation paths. For organizations with Canadian operations or data residency requirements, our sister company OnX brings the same expertise to clients across Canada.

Sometimes the right answer is optimizing your existing VMware environment. Other times, it’s a new platform or a broader hybrid cloud strategy. Either way, we’ll help you understand the implications and build a roadmap that holds up to your business priorities and your auditors.

Get your game plan for the Great VM Reset

Want to hear how other organizations are working through these decisions? Join CBTS and HPE on Wednesday, October 21, at 2:00 p.m. ET for The Great VM Reset: Is Your Infrastructure Ready for the Next Play?

You’ll hear how IT leaders are moving past virtualization costs, lock-in, and unclear ROI. We’ll also cover how they’re building hybrid cloud operating models ready for AI — without giving up control of their budget or their compliance posture.

Then stay for an exclusive discussion and Q&A with Jeff Saturday: Super Bowl champion and ESPN analyst. Jeff will share what he’s learned about leading teams through change and adversity, and what it takes to build a winning foundation when the stakes are high. Reserve your spot today.