Glossary term
Defensible record
Also: Audit trail, Decision of record
A single versioned artefact that captures a decision in enough structure, with enough evidence and stakeholder context, that it can be defended under audit, in a board review, or 12 months later when the original team is no longer in place.
The idea of a defensible record goes back to medical decision-making and military after-action review: if the decision is the object, then the record of the decision must survive its context. Personnel change. Memories fade. The record stays.
Three properties make a record defensible: it is structured enough that a third party can reconstruct the reasoning, it is evidence-backed such that each claim is traceable to a source, and it is stakeholder-signed so accountability is explicit.
In practice
In B2B technology decisions, a defensible record is usually a decision memo plus the linked evidence and stakeholder briefs. In regulated scopes, it is non-optional: NIS2 Art. 20, DORA Art. 28, ISO 27001 clause 7.5 and SOC 2 trust services criteria all effectively require a defensible record at the moment of decision.
Related terms
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
NIS2 Art. 20
The NIS2 article that makes the management body of an essential or important entity directly accountable for approving and overseeing cybersecurity risk-management measures. Management bodies that fail this duty can be held personally liable.
Dealbreaker
A hard requirement that immediately disqualifies an option if not met, independent of weighted scoring. Dealbreakers enforce non-negotiable constraints (EU hosting, specific certifications, data residency) and prevent weak options from winning on aggregate scores.
DLP
Software category for detecting and preventing unauthorised data outflow. Operates on endpoints, network and cloud. Classifies content (regex, fingerprinting, ML) and enforces policies.
DMARC / DKIM / SPF
Three standards that together authenticate email senders and impede spoofing. SPF authenticates the sending IP, DKIM signs the content, DMARC links both via the From header and defines the policy.
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
DORA ICT risk management
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).