What is risk acceptance?

A documented internal decision to tolerate a defined residual risk, with a named accountable owner and rationale.

What is verification chain?

A drafting structure linking a defined service or control to an outcome, metric, evidence artefact and consequence.

What is alternative assurance level?

A contractual assurance approach that may be agreed under DORA Article 30(3)(e)(ii) where other clients' rights are affected.

What is critical or important function?

A DORA classification that determines whether the enhanced contractual requirements in Article 30(3) apply.

Negotiate an obligation that can be verified · New case 14 — Next steps: Contracts, governance and advice

1. Start with the decision the evidence must support

The evidence question

Replace a generic promise with three questions: who decides, what do they decide, and what evidence is needed?

Under GDPR Article 32, measures must be appropriate to risk and their effectiveness must be tested, assessed and evaluated regularly.

A usable obligation identifies the metric, evidence recipient, review point and consequence of failure.

2. Separate the legal floor from the negotiated mechanism

Mandatory versus negotiated

Identify the legal duty first. Then label the metric, report format and remedy as contractual design choices, not as words dictated by the statute.

GDPR requires a processor to notify the controller without undue delay after becoming aware of a personal data breach.

NIS2 Article 21 includes supply-chain security and effectiveness assessment; Article 20 assigns approval and oversight roles to management bodies.

3. Build a verification chain, not a reporting ritual

Five-link chain

Object → outcome → measure → evidence → consequence. If one link is missing, the obligation may be difficult to monitor or enforce.

Specify an artefact: for example, a signed restoration-test record, documented exceptions, remediation owner and agreed delivery channel.

Avoid claiming that a clause guarantees security. Its practical value is that it produces evidence and a route to corrective action.

4. Apply DORA Article 30 in the right sequence

Article 30(1)

Rights and obligations must be clearly allocated in writing. The full contract includes SLAs in one durable and accessible document.

Article 30(2)

The general ICT-services minimum terms include service scope, locations, data protection, return, SLAs, incident assistance, authority cooperation and termination.

Article 30(3)

Enhanced terms apply where ICT services support a critical or important function: measurable targets, monitoring, audit, continuity and transition.

5. Case 14: the managed logging service

Conflicting evidence

Procurement sees a non-payment tool. Security sees the only evidence source for privileged access and account-takeover investigation.

Option A: accept annual assurance only. Option B: classify the dependency, then negotiate evidence, monitoring and exit terms matched to that classification.

Choose Option B: testing and remediation evidence must relate to the financial entity's real dependency, not merely the provider's generic report.

6. Negotiate evidence that survives an incident

Bounded assurance

Audit rights need not mean unrestricted data exposure. Define independent assurance, scoped follow-up evidence, redaction controls and escalation.

For critical or important functions, DORA Article 30(3) combines ongoing monitoring with access, inspection and audit rights, subject to alternative assurance where other clients' rights are affected.

A failed test, late evidence or redaction should produce an explicit cure or risk-acceptance decision, with an accountable owner.

7. Board-paper test

Thought exercise

Take this proposed clause: "Supplier shall maintain robust cyber controls and provide reports on request."

Rewrite it in one sentence using all five links:

Which exact service is covered?
What measurable result shows control operation?
Which evidence is delivered, how often, and to whom?
What is the escalation if evidence is missing or the target is missed?

Reflection: Which additional fact could change your advice, and why?

In the Harborline case, the answer most likely to reverse the enhanced DORA position is credible evidence that another independently operated log source provides equivalent, tested coverage for privileged access and incident investigation. That fact could change the criticality analysis; it would not automatically remove GDPR or other applicable security obligations.

Scenario quiz: choose the best next decision

Harborline's provider will sign a data-processing agreement and deliver an annual assurance report. It will not commit to log-ingestion targets, material-change notices, or export testing. The internal classification record is incomplete, but security states the service is currently the sole source of privileged-access logs.

What is the best next decision?

Sign now because the annual assurance report proves that the provider's security is adequate.
Pause approval, complete and document the service classification, then negotiate measurable evidence, change notification and exit or transition obligations proportionate to the confirmed dependency.
Require every supplier, regardless of role, to grant unrestricted production-system access to the financial entity.

Show Answer

Answer: B) Pause approval, complete and document the service classification, then negotiate measurable evidence, change notification and exit or transition obligations proportionate to the confirmed dependency.

The current facts point to a potentially material resilience dependency, but the classification record is incomplete. The defensible next step is to establish the factual basis and align the contract to it. If the service supports a critical or important function, DORA Article 30(3) adds enhanced monitoring, audit and transition expectations; if it does not, Article 30(2) and risk-based contractual controls still matter. An annual generic report alone does not establish Harborline-specific performance or exit readiness. The decision could change if tested evidence shows an independent equivalent logging capability and a credible, low-disruption transition path.

Key Terms

risk acceptance: A documented internal decision to tolerate a defined residual risk, with a named accountable owner and rationale.
verification chain: A drafting structure linking a defined service or control to an outcome, metric, evidence artefact and consequence.
alternative assurance level: A contractual assurance approach that may be agreed under DORA Article 30(3)(e)(ii) where other clients' rights are affected.
critical or important function: A DORA classification that determines whether the enhanced contractual requirements in Article 30(3) apply.