SkarpChapter 2 of 3
Turn an uncertain risk into a defensible decision · New case 10
Develop contracts, governance and advice while working to advise boards and product teams.
1. Frame the decision, not the uncertainty
A decision-shaped question
Ask: May live activation proceed before the disputed facts are resolved? This produces an actionable decision rather than a general discussion of risk.
Separate known facts, material unknowns, and the legal consequence if an unknown proves true. This is the foundation of a defensible record.
GDPR Article 32 requires security appropriate to risk; likelihood, severity, processing context, and available measures matter.
2. Build a fact matrix that exposes the conflict
Fact matrix
Use four fields: `assertion`, `source`, `reliability`, and `decision impact`. Treat technical evidence differently from contractual or sales assurances.
Use verified, credible but unverified, and contradicted. This avoids converting a provider promise into an internal finding.
NIS2 Article 21 addresses proportionate risk management, including supply-chain security, vulnerability handling, access control, and encryption where appropriate.
3. Identify the fact that can reverse the advice
Thought exercise
For every unresolved fact, complete this sentence:
"If this proves true, I would change the advice because..."
A fact is decision-critical only if it changes one of these:
- the likely harm or operational impact;
- the applicable contractual baseline;
- the ability to test, monitor, exit, or obtain evidence;
- whether a security measure was actually applied to affected personal data; or
- the authority level needed to accept residual risk.
If an uncertainty would not change the recommended control, commercial position, or approval route, record it but do not let it delay the decision. Conversely, a single unresolved fact can justify a temporary restriction where it could defeat containment, oversight, or recovery.
4. Case: the disputed fraud-routing service
Conflicting evidence
AsterPay's provider says it receives tokenised references only. A packet capture suggests diagnostic replies may expose device identifiers and truncated names.
The provider claims encryption and brief retention, but cannot evidence cache settings or key access. It will not permit unrestricted audit rights.
Avoid false choices: immediate launch and an indefinite total pause are both weak responses unless their conditions are explained.
5. Select a proportionate interim decision
Best interim position
Recommend a conditional no-go for live use, but allow controlled validation with synthetic data. The restriction should match the unresolved evidence, not punish the product team.
Release gates: verify data flows and cryptography; classify the function; secure a testing route; and escalate any residual risk to the proper approver.
DORA requires a risk-based testing programme and remediation. A universal pre-launch penetration test is not stated as a requirement for every entity.
6. Draft the contract by classification, not by hope
Article 30(1): document form
Article 30(1) requires clearly allocated rights and duties, with the full contract and service levels in one written, durable, accessible document.
Article 30(2): all ICT services
Article 30(2) provides the baseline contractual elements for all ICT-services arrangements, including locations, data protection, recovery, assistance, cooperation, and termination.
Article 30(3): critical or important functions
Article 30(3) adds enhanced SLAs, reporting, contingency, testing cooperation, monitoring and audit rights, and exit-transition requirements.
7. Make the board record useful under scrutiny
A defensible record
Document scope, evidence, unknowns, safeguards, owners, residual-risk approval, and reversal triggers. A conclusion without triggers is difficult to revisit rationally.
For GDPR, do not assume encryption resolves the issue. It matters where protection was implemented and applied to the affected data.
Scenario quiz: choose the best next decision
RouteSense decision
AsterPay has not verified whether diagnostic responses contain personal data or whether encryption was applied to the cache. The provider will share evidence within five business days, but will not yet accept enhanced audit and exit terms. What is the best next decision?
What should counsel recommend now?
- Approve live activation because the provider's annual assurance report is enough until a real incident occurs.
- Cancel the provider arrangement permanently because any unresolved security fact makes the service unacceptable.
- Maintain a time-limited no-go for live processing, allow synthetic-data validation, require specified evidence and classification, and escalate if release gates are not met.
Show Answer
Answer: C) Maintain a time-limited no-go for live processing, allow synthetic-data validation, require specified evidence and classification, and escalate if release gates are not met.
The third option converts uncertainty into controlled, reviewable conditions. It preserves product progress without treating vendor assurances as proof. It also keeps the DORA classification analysis open: Article 30(2) baseline terms apply to ICT-services arrangements, while Article 30(3) enhanced terms depend on support for a critical or important function. If the evidence shows affected personal data were not protected, or classification and contractual requirements cannot be satisfied, the advice should reverse to a stronger restriction and governance escalation.
Key Terms
- release gate
- A specified, verifiable condition that must be satisfied before deployment or activation may proceed.
- residual risk
- Risk remaining after safeguards and treatment measures have been applied.
- reversal trigger
- A fact or event identified in advance that requires the decision to be reconsidered or escalated.
- conditional no-go
- A temporary decision not to permit a defined live activity until objective release conditions are met.
- critical or important function
- A DORA classification that affects the enhanced contractual requirements applicable to an ICT service.