What is Service level?

A documented description of service performance expectations, measurement methods and consequences of failure.

What is Assurance ladder?

A negotiated sequence of evidence and escalation measures, such as reports, focused information requests, targeted reviews and audit rights.

What is Corrective-action plan?

A documented plan that assigns a control failure or test finding to an owner, severity, deadline and escalation route.

What is Decision-grade evidence?

Information sufficiently specific, current and attributable to enable management to decide whether risk remains acceptable and what action is required.

What is Critical or important function?

A DORA classification that determines whether the enhanced contractual requirements in Article 30(3) apply to the relevant ICT service.

Negotiate an obligation that can be verified · New case 5 — Next steps: Contracts, governance and advice

1. Start with the obligation's legal job

Give the clause a job

Reject vague security promises. Define the evidence, monitoring and corrective action that the customer needs.

GDPR evidence

GDPR Article 32 is risk-based and includes regular testing, assessment and evaluation where appropriate. Contract for evidence of those activities.

Governance and classification

NIS2 makes supply-chain security and board oversight material. Under DORA, classify whether the service supports a critical or important function before selecting the contract standard.

2. Separate the three DORA Article 30 layers

Article 30(1)

Put the full agreement and service levels in one written, durable and accessible document. Allocate responsibility clearly.

Article 30(2)

Every in-scope ICT-service contract needs baseline content. Where relevant, it must also state whether subcontracting of services supporting a critical or important function, or material parts of them, is permitted and under what conditions.

Article 30(3)

Enhanced terms apply where the service supports a critical or important function. They require measurable targets, monitoring, testing and workable exit.

3. Build a verification chain

Build a verification chain

Use this thought exercise for each proposed obligation:

Control: What must the supplier actually do?
Artefact: What record demonstrates performance?
Frequency: When is it delivered, tested, or refreshed?
Reviewer: Which operational owner reviews it?
Consequence: What happens if evidence is late, incomplete, or adverse?

A clause is verifiable only if each link has an answer. For example, "maintain tested recovery capability" becomes: perform restoration tests for the agreed service; provide a summary, exceptions and remediation plan; test at the agreed risk-based cadence and after material architecture changes; customer resilience lead reviews it; missed targets trigger corrective-action governance and, if persistent, contractual remedies.

This is proposed drafting practice, not a universal statutory test.

4. Negotiate metrics that support decisions

Measure the service boundary

A percentage without a defined service boundary, exclusions, period and source logs is not reliable evidence.

Pair metrics with proof

A recovery objective is not proof of recovery. Require test outcomes, material exceptions and corrective-action status.

Decision-grade reporting

For a critical or important function, targets should enable prompt monitoring and corrective action, not merely supplier performance reporting.

5. New case 5: the managed analytics platform

Conflicting facts

Product sees a replaceable tool. Operations sees a fraud-control dependency, personal data exposure and hidden subcontractor reliance.

Choose evidence, not labels

Assess manual workaround, disruption tolerance, substitutability, concentration and integrity risk. Record the reasoning for the board.

Reasoned position

If critical or important, negotiate the Article 30(3) framework. Annual assurance can supplement, but does not automatically replace, monitoring and audit rights.

6. Test the supplier's assurance substitute

Test the supplier's assurance substitute

When a supplier says audit rights are impossible because of multi-tenant security, ask:

Does the proposed report cover the contracted service, locations and relevant sub-processors?
Is its period current, its scope adequate, and are exceptions and remediation visible?
Can the customer obtain additional information after a material incident or control failure?
Is there a route to targeted inspection where the report cannot answer a justified concern?

For a critical or important function, Article 30(3) requires ongoing monitoring and unrestricted access, inspection and audit rights, while allowing parties to agree alternative assurance levels where other clients' rights are affected. Negotiate a proportionate assurance ladder; do not accept a blanket waiver.

7. Put remediation and exit into the evidence model

Make failure actionable

Require a corrective-action plan with severity, owner, due date and escalation. Repeated failure should inform residual-risk and continuation decisions.

Exit is operational proof

For DORA critical or important functions, test the transition path: export, completeness, access, knowledge transfer, parallel running and acceptance.

Use test outcomes

DORA testing is designed to identify weaknesses and support correction. Feed findings back into the assurance schedule and board reporting.

Scenario quiz: choose the best next decision

Scenario quiz

Northline's preliminary assessment indicates that HelioStack supports a critical or important function. HelioStack will provide only an annual assurance report and refuses all further audit or information rights. What is the best next decision?

What should counsel recommend?

Accept the annual report because it is independently issued and the supplier is widely used in the market.
Pause approval and negotiate an Article 30(3)-aligned assurance model, including measurable service levels, ongoing monitoring, audit or properly agreed alternative assurance, remediation evidence, and tested exit arrangements.
Delete security provisions because GDPR Article 32 already places security responsibility on both controller and processor.

Show Answer

Answer: B) Pause approval and negotiate an Article 30(3)-aligned assurance model, including measurable service levels, ongoing monitoring, audit or properly agreed alternative assurance, remediation evidence, and tested exit arrangements.

Option 2 is best. If the service supports a critical or important function, DORA Article 30(3) requires enhanced contractual content beyond a generic annual report, including precise performance targets, monitoring and audit rights, subject to the provision allowing agreement on alternative assurance levels where other clients' rights are affected. The answer is not that an audit must always be physically on-site; it is that the contractual model must preserve effective, ongoing verification. Option 1 treats market practice as a substitute for the applicable contract framework. Option 3 misunderstands GDPR: Article 32's shared security obligations do not remove the need for risk-appropriate processor terms or DORA contractual requirements.

Key Terms

Service level: A documented description of service performance expectations, measurement methods and consequences of failure.
Assurance ladder: A negotiated sequence of evidence and escalation measures, such as reports, focused information requests, targeted reviews and audit rights.
Corrective-action plan: A documented plan that assigns a control failure or test finding to an owner, severity, deadline and escalation route.
Decision-grade evidence: Information sufficiently specific, current and attributable to enable management to decide whether risk remains acceptable and what action is required.
Critical or important function: A DORA classification that determines whether the enhanced contractual requirements in Article 30(3) apply to the relevant ICT service.