SkarpChapter 2 of 3
Test whether governance changes the outcome · New case 6
Develop contracts, governance and advice while working to advise boards and product teams.
1. Frame the decision as a governance test
Test the decision system
A cyber issue is also a governance issue: can the organisation identify, escalate, challenge, remediate and evidence its response?
For DORA entities, the management body remains ultimately responsible for the ICT risk-management framework.
2. New case: VelaPay's release dilemma
Conflicting facts
VelaPay found production-linked token values in diagnostic logs, but the vendor says encryption and telemetry show no exfiltration.
The missing fact is governance evidence: the board approved a programme, but did not approve this exception or its residual risk.
3. Separate three legal questions
Three separate questions
Analyse the control failure, the GDPR breach assessment, and the DORA critical-or-important-function classification separately.
Do not let an assurance statement such as "no exfiltration observed" substitute for evidence that controls and governance operated effectively.
4. Apply the governance overlay
NIS2 governance evidence
Where applicable without displacement, NIS2 requires the management body to approve and oversee Article 21 measures.
For a financial entity within both regimes, DORA's corresponding cybersecurity provisions apply instead of the relevant NIS2 provisions. Assess any obligations outside that displacement separately.
5. Thought exercise: find the outcome-changing fact
Choose the fact that matters most
Before advising, ask: Who had authority to accept the residual risk, what information did they receive, and what evidence supports the decision?
Write one sentence for the board pack:
`Residual risk cannot be accepted until the accountable body receives validated evidence on log exposure, access removal, recovery impact and release conditions.`
This is proposed governance practice, not a prescribed statutory wording.
6. Turn the contract into a control mechanism
Article 30 has layers
Article 30(1) concerns written allocation. Article 30(2) sets baseline ICT-contract terms. Do not conflate them.
Article 30(3) adds enhanced terms only for critical or important functions, including audit, contingency and transition provisions.
7. Reasoned decision and reversal trigger
Best next decision
Pause the release pending a narrow evidence gate. The issue is not only the defect; it is incomplete evidence and an unapproved exception.
Reverse only on validated technical facts plus a documented, authorised and proportionate governance decision.
Scenario quiz: the next decision
Choose the best next decision
VelaPay has encryption-at-rest assurance but incomplete access telemetry, no documented criticality assessment, and no recorded approval of the release exception.
What is the best next decision?
- Launch, because encryption at rest and a vendor promise to remediate make the residual risk acceptable.
- Pause the release and require validated access, exposure, testing, criticality and accountable-approval evidence before deciding whether to proceed.
- Terminate the cloud contract immediately because any diagnostic logging issue automatically proves a DORA breach.
Show Answer
Answer: B) Pause the release and require validated access, exposure, testing, criticality and accountable-approval evidence before deciding whether to proceed.
Option 2 best tests whether governance changes the outcome. It creates an evidence-based, accountable decision gate without assuming that encryption resolves every risk or that termination is legally automatic. GDPR Article 32 requires risk-appropriate measures and effectiveness testing. For financial entities other than microenterprises, DORA also requires a comprehensive resilience-testing programme and procedures to prioritise, classify and remedy test findings, supported by internal validation methodologies.
Key Terms
- Residual risk
- The risk remaining after controls and remediation are applied, which should be accepted only through the organisation's authorised governance route.
- Effectiveness validation
- Evidence-based confirmation that an identified weakness has been fully addressed, rather than merely assigning a remediation action.
- Sector-specific Union regime
- A Union legal regime whose corresponding requirements apply instead of relevant NIS2 provisions under Article 4. DORA is expressly designated as such an act for financial entities covered by both regimes.
- Critical or important function
- A DORA classification that determines whether enhanced contractual requirements in Article 30(3) apply.