SkarpChapter 1 of 3
Negotiate an obligation that can be verified · New case 11
Develop contracts, governance and advice while working to advise boards and product teams.
1. Start with evidence, not a security promise
Move beyond a promise
A broad security promise is hard to test. Draft for an observable result that product, procurement, legal and the board can assess consistently.
The four-part formula
Object + control outcome + evidence + consequence turns a cybersecurity commitment into an obligation that can be monitored and escalated.
2. Classify the service before choosing the clause
Classification controls the baseline
First identify the legal role and operational importance of the service. GDPR may apply alongside the relevant cybersecurity framework. For a DORA-covered financial entity, DORA generally applies instead of the corresponding NIS2 cybersecurity requirements.
Do not overstate NIS2
For entities to which it applies, NIS2 requires proportionate supply-chain risk management but does not supply a complete, uniform vendor-contract schedule. For DORA-covered financial entities, use DORA instead of the corresponding NIS2 requirements.
3. Translate a control into a testable operating obligation
Example: resilience evidence
Replace "ensure resilience" with a defined restoration exercise, a dated result, identified exceptions and an accountable corrective-action owner.
Evidence is not a guarantee
A successful test supports assurance and oversight. It does not prove that future incidents cannot happen or automatically establish regulatory compliance.
4. Keep DORA Article 30(1), (2) and (3) separate
Article 30(1): document architecture
Keep the allocation of rights, obligations and service levels in one written, durable and accessible contractual document.
Article 30(2) versus 30(3)
Paragraph 2 is the minimum contractual content for ICT services. Paragraph 3 adds safeguards when the service supports a critical or important function.
5. Negotiate the evidence path, not unlimited access
A practical audit design
Routine assurance can reduce disruption, but it should not eliminate escalation to targeted audit when defined risk triggers occur.
Protect the right's effectiveness
Notice, confidentiality and coordination mechanics are sensible. They should not be drafted so restrictively that inspection or authority access cannot work.
6. Link supplier evidence to board oversight
Give evidence an owner
Supplier evidence is useful only when a named control owner assesses it, records exceptions and escalates a decision at a defined threshold.
Use the applicable governance regime
Use NIS2 Articles 20 and 21 where they apply. For a financial entity governed by DORA instead, use DORA's management-body requirements and present decisions rather than a raw audit-report dump.
7. Thought exercise: identify the missing fact
Pause and advise
A product team says its new analytics provider is "non-critical" because the customer-facing app remains available if analytics fail. Security says the provider holds production authentication logs and can remotely alter detection rules. Procurement wants to accept annual certification only.
Before choosing a clause package, ask: Could the service support a critical or important function because its compromise materially affects detection, response or continuity, even if the app itself stays online?
Write down one additional fact you would request: for example, whether product security can operate detection and response without the provider for the planned transition period. That fact may change both the DORA classification analysis and the appropriate evidence, audit and exit commitments.
8. Scenario quiz: choose the best next decision
Scenario
Harborline Finance plans to use "SignalDock", a managed detection platform. The product team says it is only an advisory tool because payments can still be processed without it. The security lead says SignalDock has privileged access to production logs and can push detection-rule changes. SignalDock offers annual ISO certification and a summary report, but rejects any customer audit or transition-assistance commitment.
What is the best next decision?
What should counsel recommend before accepting SignalDock's proposed terms?
- Accept the annual certification because the payments platform remains available if SignalDock fails.
- Treat the service as potentially supporting a critical or important function, complete and document the classification and dependency assessment, then negotiate a proportionate Article 30(3) evidence, monitoring, audit and exit package if that conclusion is confirmed.
- Require SignalDock to warrant that it will prevent every cyber incident affecting Harborline Finance.
Show Answer
Answer: B) Treat the service as potentially supporting a critical or important function, complete and document the classification and dependency assessment, then negotiate a proportionate Article 30(3) evidence, monitoring, audit and exit package if that conclusion is confirmed.
Option 2 is the best next decision. Availability of payments is relevant but not conclusive: privileged access to production logs and detection-rule changes may make the service material to security operations. If the assessment confirms that it supports a critical or important function, DORA Article 30(3) adds specific monitoring, audit and transition requirements beyond Article 30(2). For this DORA-covered financial entity, DORA generally applies instead of the corresponding NIS2 cybersecurity risk-management requirements. Option 1 prematurely treats certification as a substitute for the required contractual framework. Option 3 seeks an unrealistic outcome guarantee rather than verifiable risk controls. The decision could reverse if documented facts show that SignalDock has no production access, cannot influence detection or response, and is readily replaceable within a validated transition period.
Key Terms
- Evidence path
- The agreed artefacts, review process, timing and escalation route used to demonstrate whether a supplier obligation has been performed.
- Control outcome
- The operational result a contractual control must produce, distinct from a general promise to use good security practices.
- Assurance ladder
- A staged evidence and review model that begins with routine reporting and permits more intrusive review when defined risk triggers occur.
- Material exception
- A failure or gap meeting contractually defined severity criteria and requiring documented remediation and escalation.
- Critical or important function
- A DORA classification that determines whether the additional contractual requirements in Article 30(3) apply to ICT services supporting that function.