Glossary term
Decision memo
Also: Entscheidungsmemo, Decision record
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
A decision memo is the primary artefact produced when an organisation runs a structured technology buying decision. It is not a report, not a slide deck and not a meeting minutes document. It is a single object of record that survives personnel changes, audits and board review.
A well-formed decision memo includes: the trigger (why now), the mandate (who asked), the options on the table including status quo, the weighted criteria, the dealbreakers, the evidence behind each data point, the stakeholder positions, the risks accepted, and the decision with justification.
In practice
In regulated scopes (NIS2 Art. 20, DORA Art. 28, ISO 27001), the decision memo functions as the evidence trail that management body oversight, vendor selection and risk acceptance actually happened.
Related terms
Readiness Score
A 0-100 score that quantifies how decision-ready a memo actually is. It breaks down into criteria coverage, evidence quality, risk analysis, stakeholder alignment and formal governance. A score above 70 signals audit readiness.
Defensible record
A single versioned artefact that captures a decision in enough structure, with enough evidence and stakeholder context, that it can be defended under audit, in a board review, or 12 months later when the original team is no longer in place.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
Dealbreaker
A hard requirement that immediately disqualifies an option if not met, independent of weighted scoring. Dealbreakers enforce non-negotiable constraints (EU hosting, specific certifications, data residency) and prevent weak options from winning on aggregate scores.
DLP
Software category for detecting and preventing unauthorised data outflow. Operates on endpoints, network and cloud. Classifies content (regex, fingerprinting, ML) and enforces policies.
DMARC / DKIM / SPF
Three standards that together authenticate email senders and impede spoofing. SPF authenticates the sending IP, DKIM signs the content, DMARC links both via the From header and defines the policy.
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
DORA ICT risk management
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).