SkarpChapter 2 of 3
Negotiate an obligation that can be verified · New case 8
Develop contracts, governance and advice while working to advise boards and product teams.
1. Start with proof, not reassurance
Replace reassurance with evidence
Do not settle for "appropriate security." A useful obligation says what outcome is required, how it is measured, what evidence proves it, and what happens when it is missed.
This is a drafting technique, not a legal safe harbour. Its value is operational: product, risk, procurement and the board can test performance rather than rely on assurance language.
2. Frame the fictional case precisely
Conflicting operational facts
Product calls the fraud tool advisory. Operations says an unavailable A P I automatically blocks payment release. That operational dependency matters more than the commercial label.
Map the supported function, failure mode, data, fallback, concentration and subcontractors. These facts determine both the regulatory analysis and the evidence the contract must generate.
3. Keep the legal layers separate
DORA Article 30(1) and 30(2)
Article 30(1) concerns written allocation and the complete durable contract. Article 30(2) sets baseline contract content for all I C T services, with its subcontracting provision specifically addressing services supporting a critical or important function, or material parts of them.
Do not overextend Article 30(3)
Article 30(3) adds enhanced provisions only for I C T services supporting a critical or important function, including precise service levels and audit-related rights.
G D P R Article 32 is risk-based. It supports demanding evidence of effective measures, but it does not turn a generic control list into automatic compliance.
4. Build an evidence-to-test matrix
One risk, one proof path
For every material risk, specify a measurable obligation, a defined evidence item and a review trigger. A questionnaire is useful due diligence, not necessarily continuing contractual proof.
An S O C report may support assurance, but it may not prove service-specific availability, current subcontracting, or closure of an identified remediation action.
5. Draft a testable compromise
A proportionate audit compromise
Use recurring reports and targeted evidence as the normal route. Escalate to deeper inspection only after a defined trigger or where remote evidence cannot resolve the material risk.
For permitted subcontracting supporting critical or important functions, the in-force DORA regulatory technical standards address chain visibility, monitoring, access and material-change controls.
6. Make the board decision
Decision exercise
Prepare a one-page decision for the board committee:
- State the unresolved classification issue: the automated block may mean the service supports a critical or important function.
- Recommend conditional signature, not unconditional launch: obtain the evidence annex, subprocessor controls and viable recovery test before production dependence.
- Record the owner, evidence due date, acceptance criterion and escalation route.
For an entity in scope under applicable national implementation of the N I S Two Directive, management-body duties concern approval and oversight of Article 21 cybersecurity measures. That is a governance duty, not a substitute for supplier-specific proof.
7. Identify what could reverse the advice
Facts that lower the risk
A proven safe fallback, no material dependency and realistic substitutability could change the classification and remove the Article 30(3) overlay. Baseline duties may still remain.
Facts that increase the risk
Unknown subcontractors, untested recovery, or an unassessable material change strengthen the case for conditional launch, enhanced evidence and an exit path.
Scenario quiz: choose the best next decision
SignalHarbor says its S O C report is sufficient and will not disclose the identity or location of a new subprocessor before deployment. Fjordline's outage test shows that payment release is blocked when the fraud A P I fails. What is the best next decision?
What should Fjordline do next?
- Sign immediately because a current S O C report conclusively proves the supplier's security and resilience.
- Condition signature and production launch on a classification assessment plus defined evidence, subprocessor-change controls, recovery proof and an escalation or exit route.
- Accept the supplier's global subprocessor right because Article 30(3) applies to every I C T service contract.
Show Answer
Answer: B) Condition signature and production launch on a classification assessment plus defined evidence, subprocessor-change controls, recovery proof and an escalation or exit route.
The outage result and undisclosed subprocessor change indicate a potentially material dependency. The proportionate next step is to assess whether the service supports a critical or important function and obtain testable contractual controls before production reliance. An S O C report is relevant evidence but not conclusive proof. Option 3 is incorrect because DORA Article 30(3) is additional to Article 30(2) only for services supporting critical or important functions. The answer could change if a validated fallback shows that payment release continues safely and the service is readily substitutable.
Key Terms
- S O C report
- An independent assurance report that may be relevant evidence, but whose scope, period and exceptions must be assessed against the specific service risk.
- Evidence-to-test matrix
- A proposed contract-management tool linking a risk to a measurable obligation, a defined evidence item and a review trigger.
- Material subprocessor change
- A proposed change in subcontracting that may affect the customer's risk exposure or the supplier's ability to meet its contractual obligations.
- Critical or important function
- Under DORA, a function whose disruption, defective performance or failure would materially impair financial performance, service continuity, or continuing compliance with applicable financial-services obligations.