What is residual risk?

The risk remaining after controls are applied and evidenced; it should be described specifically enough to support an accountable acceptance decision.

What is management body?

The governing body whose role under applicable NIS2 implementation includes approval and oversight of cybersecurity risk-management measures.

What is conditional approval?

A governance decision permitting progress only when defined evidence, controls, or contract conditions have been satisfied and verified.

What is personal data breach?

A GDPR event involving accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

What is critical or important function?

A DORA classification that materially affects the contractual controls, testing expectations, monitoring, and exit arrangements for an ICT service.

Test whether governance changes the outcome · New case 12 — Next steps: Contracts, governance and advice

1. Frame the decision as a governance test

Governance is a test

A governance change is meaningful only where it changes decision rights, evidence, or escalation for the risk at issue.

Ask: Would the outcome differ if the management body approved the risk treatment on today's evidence? If yes, governance is substantive.

For applicable NIS2 entities, management bodies must approve and oversee Article 21 measures; supply-chain and effectiveness controls are part of that assessment.

2. New case: AsterPay's analytics release

Conflicting facts

Product says rotating tokens are anonymous. Security says the provider can query AsterPay's token-to-account lookup table during incident support.

Procurement calls the service non-critical. Operations says four hours without it disrupts dispute, fraud-review, and reimbursement decisions.

The provider offers assurance reporting but rejects audit rights and resilience-test participation. The board wants launch approval in two weeks.

3. Separate classification from risk acceptance

Build a classification record

Document the service, disruption tolerance, data flows, dependencies, operating evidence, and residual risk proposed for acceptance.

DORA has applied directly since 17 January 2025. Its pre-contract assessment includes criticality, risks, provider suitability, supervisory conditions, and conflicts.

A commercial label is not dispositive. Test the effect of loss, degradation, or compromised integrity on continuity, performance, and compliance.

4. Match the contract to the result

Article 30(1) and 30(2)

Article 30(1) requires written allocation of rights and obligations. Article 30(2) supplies minimum terms for all ICT-service contracts.

Keep Article 30(3) separate

Article 30(3) adds stronger terms only for services supporting a critical or important function, including monitoring, audit, testing cooperation, and transition.

Recommend conditional approval: classification first, then contract alignment, then release. That is governance practice, not a guarantee of enforceability.

5. Test the control, not the promise

Assurance is not proof

A provider report does not prove the financial entity's own resilience compliance. Test the dependency and validate remediation.

DORA requires independent, risk-based testing and procedures to prioritise, remedy, and validate findings; critical or important systems require appropriate annual tests.

Turn every finding into an owner, date, validation criterion, and escalation trigger. Do not approve an unknown risk.

6. Preserve the separate GDPR analysis

Do not rely on the label

Where tokens remain linkable through reasonably available information, assess the logs cautiously as personal data rather than calling them anonymous.

GDPR Article 32 requires risk-appropriate measures, including resilience, restoration capability, and regular effectiveness testing.

A board approval does not change GDPR breach assessments. Encryption may matter to Article 34 communication, but does not remove the need for analysis.

7. Decision memo exercise

Draft the one-page recommendation

Write four lines for the board pack:

Decision requested: conditional launch approval, not unconditional acceptance.
Conditions precedent: documented criticality and data assessment; contract terms aligned to the confirmed classification; testing and remediation evidence reviewed by named control owners.
Residual risk: specify the service dependency and consequence, rather than saying "vendor risk."
Reversal fact: the advice could change if testing proves the service does not support a critical or important function and the provider has no ability to re-identify individuals from the logs. Even then, reassess the Article 30(2) baseline terms and GDPR security obligations.

Reflection: Which additional fact could change your advice, and why?

8. Scenario quiz: choose the best next decision

AsterPay has not completed its criticality assessment. The provider refuses audit rights and resilience-test cooperation. The service may materially affect fraud-review and reimbursement operations, and the supposedly anonymous logs may be linkable through a lookup service.

What is the best next decision?

What should counsel recommend to the board?

Approve launch because the provider's annual assurance report is sufficient evidence and the service is not labelled critical by procurement.
Give conditional approval only after documented classification, data-flow assessment, contract alignment, and proportionate testing and remediation evidence.
Approve launch if management records a general acceptance of all cybersecurity and privacy risks.

Show Answer

Answer: B) Give conditional approval only after documented classification, data-flow assessment, contract alignment, and proportionate testing and remediation evidence.

The unresolved facts determine both the control posture and the contractual consequence. Procurement's label and a provider assurance report do not replace DORA's pre-contract assessment or, if the function is critical or important, the additional Article 30(3) terms. Nor does governance approval displace GDPR Article 32 security duties or breach analysis. The answer could change if credible evidence establishes that the service is not critical or important and the logs are genuinely non-personal, but Article 30(2) baseline contractual terms and risk-appropriate controls would still require assessment.

Key Terms

residual risk: The risk remaining after controls are applied and evidenced; it should be described specifically enough to support an accountable acceptance decision.
management body: The governing body whose role under applicable NIS2 implementation includes approval and oversight of cybersecurity risk-management measures.
conditional approval: A governance decision permitting progress only when defined evidence, controls, or contract conditions have been satisfied and verified.
personal data breach: A GDPR event involving accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
critical or important function: A DORA classification that materially affects the contractual controls, testing expectations, monitoring, and exit arrangements for an ICT service.