SkarpChapter 2 of 3
Turn an uncertain risk into a defensible decision · New case 4
Develop contracts, governance and advice while working to advise boards and product teams.
1. Frame the decision, not the uncertainty
Make the decision bounded
Advise on whether the service may progress, under which conditions, and who re-approves if key facts change. Supplier labels are evidence, not conclusions.
Classify the dependency
Map the business process, data, substitutability, concentration and exit. DORA requires pre-contract criticality, risk, due-diligence and conflict assessment.
2. New case: the "E U-only" fraud-triage tool
The proposed service
SignalArc ranks payment alerts. The team calls it advisory and wants a rapid pilot followed by production use during a fraud peak.
The conflicting evidence
Marketing promises E U-only, no-retention processing. Architecture shows pseudonymous telemetry, a US support subcontractor, weak fallback capacity and shared cloud-group reliance.
3. Separate the legal questions
Use three tests
Test service dependency under DORA and personal-data security risk under GDPR. For NIS2, first apply the Article 4 sector-specific-law rule; if Article 20 nevertheless applies, assess governance under the applicable national implementation.
One fact, different effects
Fallback weakness informs DORA criticality; telemetry informs GDPR; an incomplete evidence pack affects whether the board can exercise meaningful oversight under the applicable framework.
4. Evidence triage exercise
Evidence triage exercise
Before drafting a conclusion, sort each item into known, supplier assertion, or decision-critical unknown:
- Where telemetry is processed, stored and accessed
- Whether identifiers can be linked back to individuals
- Which subcontractors support the service or a material part
- Maximum safe outage before fraud controls become unacceptable
- Whether another provider can take over within that outage window
Now ask: Which one fact, if proved differently, would reverse your recommendation? Put that fact at the top of the evidence request and give it an owner and a deadline.
5. Draft the contract in the right layers
Article 30(1) and 30(2)
Paragraph 1 concerns written allocation and durable documentation. Paragraph 2 sets baseline content, including the service description and service and data locations. For services supporting a critical or important function, or a material part of one, it also addresses whether subcontracting is permitted and under what conditions.
Article 30(3) is additional
Critical or important-function arrangements add further requirements: measurable service levels, continuity, security, audit, notice and exit protections.
6. Address subcontracting and privacy without overclaiming
Subcontracting evidence
Require the relevant chain, actual service and data locations, monitoring evidence and change controls. The 2025 DORA RTS addresses permitted critical-function subcontracting.
Privacy evidence
Pseudonymisation is not a complete answer. Test linkability, retention, access, security and incident assistance; then apply GDPR risk thresholds to any breach.
7. Give the board a reversible, evidenced recommendation
Recommended decision
Approve only a segregated, time-limited pilot. Make production conditional on verified classification, maps, fallback testing, concentration analysis and contract controls.
Define reversal triggers
Record the facts that would lighten or intensify the route. The defensible output is an assumption register and decision record, not a risk-free assurance.
Scenario quiz: choose the next decision
Scenario quiz
SignalArc will begin processing live transaction telemetry next week. The supplier has not identified all observability subcontractors or confirmed whether account-linked identifiers reach the US support environment. Harborline has not tested its manual fallback. What is the best next decision?
What should Harborline's board committee decide now?
- Approve production because investigators retain final payment decisions.
- Approve only a constrained pilot, freeze production reliance, and require verified classification, data-flow, subcontracting, fallback and contract evidence before re-approval.
- Reject the service permanently because any US-based subcontractor makes the arrangement unlawful.
Show Answer
Answer: B) Approve only a constrained pilot, freeze production reliance, and require verified classification, data-flow, subcontracting, fallback and contract evidence before re-approval.
Option 2 converts material uncertainty into controlled conditions and preserves a reversible decision. Human review does not resolve dependency, concentration, subcontracting or personal-data risk. A US subcontractor is not, by itself, enough to conclude permanent unlawfulness; the relevant facts and applicable safeguards must be assessed. Article 30(2) requires the contract to state whether subcontracting is permitted and under what conditions where an ICT service supports a critical or important function, or a material part of one. If the service supports a critical or important function, DORA Article 30(3) also adds enhanced contractual requirements beyond Article 30(1) and 30(2). For this DORA-covered financial entity, apply the NIS2 Article 4 sector-specific-law rule before treating NIS2 risk-management, reporting or governance provisions as applicable; if Article 20 nevertheless applies, assess it subject to national implementation.
Key Terms
- segregated pilot
- A limited deployment designed to test evidence and controls without creating unapproved production dependency.
- concentration risk
- Risk arising from reliance on a provider or closely connected providers that may be difficult to substitute.
- assumption register
- A controlled list of unverified facts, their decision impact, evidence owner, deadline and escalation trigger.
- critical or important function
- A DORA classification that determines whether enhanced contractual requirements apply to ICT services supporting that function.