The IT provider says it manages the platform. The software vendor says it operates the application. The business assumes one of them monitors unusual access and can recover the service. Each contract may be accurate while the company still has a gap nobody owns.
For a Norwegian board, the useful question is whether management can show how critical business services are protected and restored across those boundaries. Buying IT support does not, by itself, answer that question. The company needs enough internal competence and authority to specify the service, judge the evidence and act on unresolved risk.
Follow one delivery across the contracts
Take a hypothetical wholesaler whose orders arrive by email, enter a cloud business system and pass to a warehouse application. One provider supports employee devices and identity accounts. Another supplies the business software. A third integration moves the orders.
Do not begin with a catalogue of security products. Follow an order from receipt to dispatch. Which accounts, integrations and records does it depend on? Who can see an incorrect change? Who can stop the integration? Who decides whether dispatch should continue if the order data cannot be trusted?
NSM's guidance on outsourcing and cloud services recommends control throughout the lifecycle, sound purchasing competence, risk assessment and decisions at the right level. That is a basis for management follow-up, not a demand that the board run IT operations.
Separate performance of a task from ownership of a decision
For each critical service, management should record the internal accountable owner, the provider performing the work, the evidence expected and the escalation route. Avoid recording two parties as jointly responsible without saying who must act first.
In the wholesaler, the provider may remove an employee's account, while the company's manager must notify it promptly and confirm which business-system access also needs removal. A provider may operate backups, while the business must define which data and interruption limits matter. The technical team can recommend restoration; operations must confirm that orders reconcile correctly.
Check monitoring in the same way. Does someone review alerts outside normal hours? Which systems are included? Who can authorize urgent intervention? A statement that monitoring is available is different from an agreed and staffed response service.
Ask for evidence at the boundary
At the next supplier review, request a small set of service-specific demonstrations:
- A recent departure or role change, showing that relevant access was removed or adjusted across systems.
- A restoration test showing what was restored, how long it took and which dependencies were excluded.
- An incident exercise showing who received the alert, who acted and who communicated with management.
- A current list of unresolved weaknesses, including their business consequences, owners and dates for decisions.
These are my suggested checks. Match their depth and frequency to the service's importance. A percentage of successful backup jobs is useful operational information, but it does not demonstrate that the complete order process can be restored. Ask what evidence would expose a gap, not merely confirm that a product is installed.
Keep control when the normal contact is unavailable
Company ownership of domains, subscriptions and essential records should be clear. Establish controlled emergency access and a deputy who can use the agreed procedure. This does not mean sharing administrator passwords widely or keeping an unprotected spare account.
Clarify what happens if the provider is unavailable or the contract ends: access to logs, configuration records, data exports, assistance and secure handover. Test a practical part of the arrangement. Read the AI supplier exit article when the dependency also involves models, prompts and task evaluation.
Where the company is a controller of personal data, outsourcing processing does not eliminate its controller obligations. GDPR Articles 24 and 28 address accountability and the processor arrangement. Determine roles by the actual processing, and assess applicable security and notification duties. A support contract is not automatically a sufficient data-processing agreement.
Give the board a decision, not an inventory
Management should bring the board a short account of critical services, evidence from recent tests, material gaps and the proposed response. For the wholesaler, that might be a choice between funding a tested manual dispatch process and accepting a longer interruption while recovery is improved.
The board should challenge whether the residual risk fits the business, whether management has the resources to address it and whether commitments to customers remain credible. Management assigns tasks and follows implementation. Neither a green dashboard nor a supplier's reassurance should replace evidence of the service the company depends on. Use the board cyber risk report to turn those findings into a clear request for a decision.
Start with one important delivery and one cross-provider gap. Use the cyber-incident exercise to test the arrangement under pressure, and the customer-evidence guide before turning supplier statements into sales promises.
Sources and scope
Sources checked on 12 October 2026. The wholesaler and contract boundaries are hypothetical. The review method is my recommendation, informed by NSM guidance. Security-law and sector-specific requirements must be assessed separately; they do not apply identically to every Norwegian AS.