SkarpChapter 1 of 3
Turn an uncertain risk into a defensible decision
Develop contracts, governance and advice while working to advise boards and product teams.
1. Frame the decision, not the uncertainty
Decide what needs deciding
Replace "Is it secure?" with a decision: approve, approve with conditions, defer, or reject. State the service, use case, and accountable residual-risk owner.
Make uncertainty visible
Separate known facts, assumptions, and unknowns. This prevents a confident conclusion from resting on an untested supplier statement.
GDPR Article 32 calls for measures appropriate to risk, not an assurance of perfect security. Your advice should show the reasoning and evidence behind the chosen measure.
2. Build a legal-control map
Use a four-column map
`Risk event → legal driver → control objective → evidence needed` keeps advice tied to the decision rather than to a generic list of security controls.
Under GDPR Article 32, a privileged-access risk can support objectives such as confidentiality, access governance and resilience. The measure must fit the actual processing risk.
Where DORA applies as the relevant sector-specific Union act, its corresponding provisions apply instead of the relevant NIS2 provisions, including Articles 20 and 21. Otherwise, NIS2 Articles 20–21 connect risk management to management-body approval and oversight. Do not infer national director-liability rules from the Directive alone.
3. Test materiality before escalating
Thought exercise: the reversal test
For each unknown, complete this sentence:
`If we learned [fact], the recommendation would change from [decision] to [different decision] because [legal or operational consequence].`
Prioritise only unknowns that could reverse the decision, materially change a required safeguard, or prevent the board from exercising meaningful oversight.
Examples:
- The provider cannot identify processing or service-delivery locations.
- A subcontractor may administer production systems without prior notice.
- Recovery testing covers a test environment but not the production dependency.
A missing low-value artefact may justify a remediation action. A missing fact about location, privileged access, subcontracting, or recoverability may justify deferral. This is a triage exercise, not a demand for exhaustive diligence.
4. Keep DORA contract layers distinct
Article 30(1): document and allocate
Rights and obligations must be clearly allocated in writing. The full contract, including service-level agreements, must be in one written document available to the parties on paper or in another downloadable, durable and accessible format.
Article 30(2): baseline content
Apply the minimum contractual elements to ICT services, including a complete description; all required regions or countries for service provision and data processing, including storage; advance notice of location changes; data access and recovery; service levels; incident support; authority cooperation; and exit.
Article 30(3): criticality uplift
Additional terms apply when services support a critical or important function. Document the classification before asserting the enhanced requirement.
5. Work the conflicting facts
Conflicting evidence
Encryption and testing support approval. Incomplete location information, flexible subprocessors and unverified recovery point the other way. Treat neither set of facts as decisive alone.
Reasoned decision
Choose a bounded pilot with conditions, not automatic approval or indefinite deferral. Conditions must close the uncertainties that could alter legal and operational risk.
Reversal facts
Critical-function support, an unworkable fallback, or undisclosed privileged access could reverse the decision. State those triggers explicitly in the advice.
6. Turn controls into decision conditions
Write conditions that can be tested
Specify evidence, owner and consequence. "Improve security" is not a decision condition; complete location information, a reviewer and a pause trigger are.
DORA Article 24 requires a comprehensive testing programme for financial entities other than microenterprises. Microenterprises follow the proportionate testing approach in paragraph 3. Supplier reports do not alone satisfy the entity's applicable responsibilities.
DORA Article 26 requires selected financial entities—excluding microenterprises and entities under the specified simplified framework—to conduct threat-led penetration testing at least every three years, unless the competent authority adjusts the frequency under the Regulation.
7. Preserve the decision record
The decision packet
Capture scope, including the DORA and NIS2 relationship, facts, uncertainty, options, chosen rationale, conditions, owners and review triggers. Separate mandatory obligations from recommended safeguards.
Where corresponding NIS2 governance provisions apply, management bodies need enough information to approve and oversee risk measures, not a technical document they cannot challenge. Product teams need the same analysis as release gates.
An incident is not automatic proof of poor advice. Defensibility depends on proportionality, evidence, transparent uncertainty and continued monitoring.
8. Scenario quiz: choose the next decision
A critical unknown remains
A financial entity has evidence that an ICT provider encrypts data and has incident-response procedures. The contract identifies the primary hosting country but does not identify the regions or countries from which subcontractors provide support access. The service may support a critical or important function, and that classification has not been completed. Product requests immediate production launch.
What is the best next decision?
What is the best next decision?
- Approve production launch because encryption and incident procedures show that the provider is secure.
- Defer the production decision until the criticality classification and the required subcontractor support-location evidence are completed, then determine the applicable Article 30 contractual layer.
- Reject the provider permanently because any undisclosed subcontractor location is necessarily unlawful under EU cybersecurity law.
Show Answer
Answer: B) Defer the production decision until the criticality classification and the required subcontractor support-location evidence are completed, then determine the applicable Article 30 contractual layer.
The unresolved facts could change both the dependency assessment and the applicable DORA Article 30 requirements, particularly whether Article 30(3) applies. Article 30(2) also requires identification of the regions or countries where contracted or subcontracted functions and ICT services are provided and where data is processed, including storage locations, with advance notice of changes. Encryption and incident procedures do not resolve those issues. Permanent rejection is not compelled on these facts; the proportionate decision is to close the material uncertainty before production approval.
Key Terms
- Decision gate
- A defined point at which specified evidence or conditions must be satisfied before a project may proceed.
- Residual risk
- Risk remaining after controls and conditions have been applied, which must be consciously accepted by an appropriately accountable owner.
- Reversal trigger
- A fact or event identified in advance that would require the organisation to reconsider or change its decision.
- All-hazards approach
- NIS2's approach to cybersecurity risk management, requiring risks to be considered broadly rather than only as malicious cyberattacks.
- Critical or important function
- A DORA classification that triggers additional contractual requirements under Article 30(3) when ICT services support that function.