SkarpChapter 1 of 3
Turn an uncertain risk into a defensible decision · New case 7
Develop contracts, governance and advice while working to advise boards and product teams.
1. Start with the decision, not the incident label
A defensible decision
The aim is not certainty. It is a proportionate, evidenced action that can be explained to the board, product team, and supervisor.
Identify the immediate decision, classify the service, and isolate the one uncertainty that could genuinely change the recommendation.
For DORA entities, third-party risk remains the financial entity's responsibility and arrangements must be distinguished by criticality.
2. New case: Northlight's transaction-authentication tool
Competing pressures
The product benefit is immediate: fewer false declines. The security concern is also immediate: a recently remediated privilege-escalation flaw.
Tokenisation does not itself settle GDPR analysis where Northlight can reverse the token and link the information to a person.
The realistic choices are full deployment now or a controlled interim pilot with evidence gates.
3. Apply the correct legal lens
Do not double-count or overextend displacement
For Northlight, confirm whether it is identified as an NIS2 essential or important entity before applying DORA's sector-specific displacement of the relevant NIS2 requirements.
GDPR remains independently relevant because the same weakness may affect the confidentiality, integrity, or availability of personal data.
Assess SignalHarbor's own NIS2 position separately; serving a DORA-covered customer does not displace the provider's independent obligations.
4. Classify criticality using consequences
Classify by impact
Ask what happens if the service fails, is manipulated, or becomes unavailable. Do not infer criticality from a vendor's marketing category.
Map the chain from customer transaction to vendor service, including administration access, data flows, and subcontractors.
DORA requires pre-contract criticality, risk, concentration, due-diligence, and conflict assessments.
5. Turn uncertainty into contract and evidence gates
Article 30(1)
Put allocated rights, obligations, and service levels in a complete written contract held in a durable, accessible format.
Article 30(2) versus 30(3)
Paragraph 30(2) is the minimum for all ICT services. Paragraph 30(3) adds requirements only for critical or important functions.
Make approval conditional on evidence gates: patch validation, dependency map, exit feasibility, and tested fallback.
6. Decision-record exercise
Write the one-page recommendation
Complete these prompts before advising the board:
- Decision requested: approve a constrained pilot, full rollout, or pause?
- Known facts: patched flaw; no evidence of exploitation; reversible tokenisation; transaction-authentication dependency.
- Assumptions: vendor evidence is complete; Northlight can route transactions through a fallback process.
- Controls before expansion: independent validation of the patch, least-privilege review, monitored logs, pilot volume cap, and exit rehearsal.
- Owner and review point: name the accountable executive and set a short evidence-review date.
This structure shows why the recommendation is proportionate. It also prevents an uncertain technical statement from being silently converted into a legal conclusion.
7. Make the reasoned decision and name the reversal fact
Best current decision
Approve a capped, monitored pilot with contractual and technical evidence gates. Do not approve an unconditional full rollout.
This is a proportional recommendation, not a claim that the tool is prohibited by DORA or GDPR.
A fact that removes material dependency could relax the recommendation. Active exploitation or no fallback should tighten it to a pause.
Scenario quiz: choose the best next decision
Northlight has the vendor patch statement but no independent validation, no confirmed subcontractor map, and no tested fallback. The product team requests full production deployment tomorrow.
What is the best next decision?
- Approve full deployment because the vendor reports no evidence of exploitation and the data are tokenised.
- Pause every use permanently because any recently patched privilege-escalation flaw makes a cloud service non-compliant.
- Approve only a capped, monitored pilot if defined evidence and contractual gates are met; otherwise pause and remediate.
Show Answer
Answer: C) Approve only a capped, monitored pilot if defined evidence and contractual gates are met; otherwise pause and remediate.
The third option converts uncertainty into controlled, reviewable conditions. The vendor assurance and tokenisation do not resolve dependency, re-identification, subcontracting, resilience, or contractual-control questions. A permanent ban is also unsupported on these facts. The board can authorise a proportionate pilot only where the fallback, validation, monitoring, and Article 30 contract analysis are completed to the level required by the service's confirmed criticality. Northlight's NIS2 status and SignalHarbor's potentially independent NIS2 status must also be assessed separately; DORA coverage of the customer does not displace the provider's own obligations.
Key Terms
- evidence gate
- A proposed governance condition that must be evidenced before a deployment expands, such as independent patch validation or a successful fallback test.
- residual risk
- The risk remaining after planned or implemented controls are considered.
- ICT third-party risk
- Risk arising from an ICT service provider relationship. Under DORA, it remains part of the financial entity's own ICT-risk management.
- reversible tokenisation
- A technique that substitutes an identifier with a token while retaining a means to link it back to an individual. It does not necessarily remove the data from GDPR scope.
- critical or important function
- A function whose disruption or defective performance may materially affect a financial entity's operations, regulatory compliance, or continuity; its classification drives heightened DORA third-party controls.