Evidence that agreed telemetry is arriving, parseable, and sufficiently complete for the stated monitoring use.

What is coverage exception?

A documented period or condition in which agreed monitoring inputs or analytic coverage were unavailable, degraded, or excluded.

What is monitoring perimeter?

The systems, telemetry, and activities that the supplier has agreed to monitor.

What is customer-managed integration?

An interface, gateway, connector, or related component operated and controlled by the customer rather than the supplier.

What is DORA critical or important function?

A function whose supporting ICT service triggers the additional contractual requirements in DORA Article 30(3), for an entity within DORA's scope.

Turn a supplier security promise into a testable commitment — Next steps: Incident response and evidence

1. Separate the promise from the commitment

A slogan is not a perimeter

A claim such as "continuous security monitoring" may reassure, but it does not say what is monitored, what is excluded, or how performance is proved.

Draft operational parameters

Treat scope, obligation, dependencies, evidence, and verification as practical drafting parameters. They make the promise reviewable without deciding enforceability under unspecified national law.

Use frameworks carefully

NIST CSF 2.0 supplies risk-management outcomes and common language; it does not prescribe implementation or create NIST certification.

2. Draw the monitored boundary

Visualise the boundary

Picture a line around the supplier-managed SaaS estate. Put the customer API gateway and customer SIEM outside it, but draw the telemetry crossing the line.

Name monitored objects

List the systems and signals: production hosts, identity plane, application logs, managed connectors, and interface telemetry actually received by the supplier.

Make exclusions usable

Say what the supplier does not monitor, administer, patch, or assure. Then specify the customer controls and data needed at the boundary.

3. Identify the dependency facts

Thought exercise

Before accepting the exclusion, obtain facts that make reliance rational:

Which gateway events are forwarded, in which format, and with what expected delivery latency?
Who owns credentials, certificates, parsing rules, clock synchronisation, retention, and health checks?
Can the supplier distinguish absent telemetry from no suspicious activity?
Does the gateway carry personal data or provide a function material to a regulated financial service?

Write one sentence beginning: "Supplier monitoring depends on Customer..."

4. State the actual obligation

Use a bounded outcome

A workable obligation covers continuous collection and analysis of listed telemetry, investigation of agreed-severity alerts, and recorded disposition.

Do not promise omniscience

Avoid "detect all threats." Attach log sources, analytic coverage, severity criteria, retention, and exception handling instead.

Allocate customer work

The customer can undertake to maintain its gateway, preserve the agreed logs, and remedy failed forwarding. Dependencies should be affirmative, not buried in an exclusion.

5. Worked negotiation: choose a defensible position

The fact pattern

CloudLedger says it provides "24/7 continuous monitoring." FinCo owns a gateway that forwards authentication and API events into CloudLedger's monitoring flow.

Proposal A: supplier-led assurance

Supplier monitors its estate and validates daily that the feed is present and parseable. Feed failure creates a ticket and appears in the monthly assurance pack.

Proposal B: customer-led boundary

Supplier monitors only its estate. Customer monitors its gateway and supplies a quarterly attestation that forwarding and alerting controls operated.

Decision

Choose Proposal A if the feed materially affects supplier-service detection. It makes the dependency observable. Proposal B may fit a low-risk interface with mature customer monitoring.

6. Match evidence to the promise

Posture evidence is not performance evidence

A certificate or SOC report may evidence diligence. It will not normally show whether this customer feed arrived, was parsed, and was covered during the review period.

Request testable artefacts

Use risk-proportionate evidence: feed-health results, coverage exceptions, sampled alert dispositions, and remediation status. Protect other customers through redaction or aggregation.

GDPR: only when roles fit

Where the supplier is a processor, Article 28 addresses security, assistance, information, and audits; Article 32 requires risk-appropriate measures and regular effectiveness testing.

7. Control change and verify

Changes can hollow out coverage

A monitoring commitment can degrade when telemetry, analytics, location, or a monitoring subcontractor changes. Define which changes are material.

Pair notice with a remedy

A negotiated option is prior notice of material reduction, with a narrow emergency exception, plus restoration of equivalent coverage or compensating controls.

DORA has distinct layers

For in-scope financial entities, DORA Article 30(1) allocates rights and obligations in writing; 30(2) gives ICT-contract minima; 30(3) adds terms for critical or important functions.

8. Scenario quiz

Choose the strongest next move

A supplier excludes the customer-managed gateway but continues to advertise continuous monitoring. The gateway's authentication logs are essential to detect suspicious use of the supplier API. What should counsel prioritise?

Which proposal best turns the claim into a reliance-ready commitment?

Accept the slogan because the supplier has an ISO certificate.
Define the monitored supplier estate and received gateway telemetry; state customer feed obligations; require feed-health evidence, material-change notice, and a proportionate verification right.
Require the supplier to guarantee detection of every threat in the customer gateway.

Show Answer

Answer: B) Define the monitored supplier estate and received gateway telemetry; state customer feed obligations; require feed-health evidence, material-change notice, and a proportionate verification right.

The second option converts the claim into a bounded, observable service. It preserves the gateway exclusion while making the critical dependency, evidence, change control, and verification explicit. A certificate alone does not prove service-specific performance, and an absolute threat-detection guarantee is usually neither technically bounded nor risk-calibrated.

Key Terms

feed health: Evidence that agreed telemetry is arriving, parseable, and sufficiently complete for the stated monitoring use.
coverage exception: A documented period or condition in which agreed monitoring inputs or analytic coverage were unavailable, degraded, or excluded.
monitoring perimeter: The systems, telemetry, and activities that the supplier has agreed to monitor.
customer-managed integration: An interface, gateway, connector, or related component operated and controlled by the customer rather than the supplier.
DORA critical or important function: A function whose supporting ICT service triggers the additional contractual requirements in DORA Article 30(3), for an entity within DORA's scope.