Board request to defer DORA remediation at a life insurer
Northbridge Life is an EU life insurer with 850 staff, 2.1 million policyholders and €9bn in assets. Its core policy administration and claims platform is SaaS from a US provider; 63 ICT arrangements support operations. A January 2025 internal audit found the register of information missing 38 arrangements, no business impact analysis since 2021, an incident playbook still in draft, and no exit plan for the policy platform. The CIO wants to defer remediation to Q2 2026, arguing DORA is new, the insurer is not a bank, and the supervisor has not asked for evidence. The board asks whether it can rely on proportionality and what to fix first. The provider contract has no audit rights, no data-location commitment and a 30-day termination right. The insurer also uses two small EU hosting providers for backup and email.
1. Advise the board on whether Northbridge Life can defer DORA remediation and how proportionality should affect sequencing. Identify the first three actions.
Read the worked answer
Position. DORA has applied since 17 January 2025 to insurers as financial entities. There is no waiting period tied to supervisory requests. Proportionality allows the framework to fit the insurer's size, risk profile and complexity, but it is not an exemption for an 850-staff insurer with 2.1 million policyholders. The board cannot approve a blanket deferral; it can approve a risk-based sequence with dated milestones.
Why deferral is weak. The missing register is not paperwork. It is the basis for identifying critical functions, concentration risk, subcontracting and exit options. The absent BIA means Northbridge cannot credibly set recovery objectives for policy administration or claims. The draft incident playbook means a major incident could miss the regulatory clock. The SaaS contract without audit rights or exit assistance is a live third-party risk.
First three actions. 1) Complete the register of information, starting with the policy platform and the 38 missing arrangements. 2) Finalise incident classification, escalation and reporting procedures, including named owners and decision logs. 3) Complete a BIA for policy administration and claims and use it to test the SaaS exit plan. Contract remediation should run in parallel, not after. The board should receive monthly metrics and a written risk acceptance for any residual gap.
2. The US SaaS provider refuses audit rights and data-location commitments. What are the DORA implications and what should Northbridge do before contract renewal?
Read the worked answer
Implications. Policy administration and claims are likely to support critical or important functions. DORA requires the contract to include clear service description, data location, availability and reliability, access and audit rights, cooperation with authorities, termination and exit assistance, and subcontracting conditions. A SOC 2 report may be useful evidence, but it is not a substitute for contractual access, inspection and audit rights. DORA does not impose a blanket EU data-localisation rule, but Northbridge must know where data is processed and assess the legal and operational risk.
Before renewal. Northbridge should classify the service, document the gaps and issue a remediation schedule. It should negotiate audit rights that cover the provider and relevant subcontractors, a data-location schedule, exit assistance and a longer termination notice. If the provider refuses, the board needs a documented risk assessment and an alternative-provider or exit analysis, not an automatic renewal. The register must show the provider, the function and any subcontractors. If the provider is later designated a critical ICT third-party provider, the lead overseer may make recommendations, but Northbridge remains responsible for its own third-party risk management.
3. What should the board be told about its own accountability and the use of the register of information?
Read the worked answer
The board should be told that DORA places the ICT risk management framework and risk appetite under the management body's accountability. Execution can be delegated to the CIO, CISO and business owners, but approval and oversight cannot. The board should approve the risk appetite, the remediation plan and any time-bound risk acceptance, and should challenge whether the insurer can remain within tolerance.
The register of information should be presented as a management tool and a supervisory evidence source. It identifies critical functions, providers, subcontractors, data locations and contract expiry dates. Missing 38 of 63 arrangements is material because it undermines concentration analysis and exit planning. The board should ask for completeness metrics, ownership, verification and a rule that new or renewed contracts cannot go live without register entry and contract review. It should also receive incident metrics and test results so that it oversees outcomes, not just project status.