Glossary term
Dealbreaker
Also: Knock-out criterion, Ausschlusskriterium
A hard requirement that immediately disqualifies an option if not met, independent of weighted scoring. Dealbreakers enforce non-negotiable constraints (EU hosting, specific certifications, data residency) and prevent weak options from winning on aggregate scores.
A dealbreaker is different from a criterion. Criteria are weighted and summed; dealbreakers are binary filters that run before scoring. If an option fails a dealbreaker, it is out regardless of how well it scores elsewhere.
In regulated decisions, dealbreakers usually map to regulatory constraints that cannot be traded against price or features. Common examples: EU-only data residency under DORA, ISO 27001 certification for a critical vendor, BSI C5 testing in public-sector procurement, NIS2-compatible incident reporting cadence.
In practice
The procedural value is huge: by separating dealbreakers from weighted criteria, a decision memo cannot accidentally award a contract to a vendor that is not actually eligible. This is one of the most frequent sources of post-signature reversal in enterprise buying.
Related terms
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Vendor matrix
A structured comparison of vendor options across weighted criteria, showing scores, evidence per cell and an aggregate result. A good vendor matrix separates dealbreakers from weighted criteria and makes every score traceable to a source.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Defensible record
A single versioned artefact that captures a decision in enough structure, with enough evidence and stakeholder context, that it can be defended under audit, in a board review, or 12 months later when the original team is no longer in place.
DLP
Software category for detecting and preventing unauthorised data outflow. Operates on endpoints, network and cloud. Classifies content (regex, fingerprinting, ML) and enforces policies.
DMARC / DKIM / SPF
Three standards that together authenticate email senders and impede spoofing. SPF authenticates the sending IP, DKIM signs the content, DMARC links both via the From header and defines the policy.
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
DORA ICT risk management
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).