· Yair Knijn
The board report that had a revenue number but no operational resilience number
The CTO gets fifteen minutes on the board agenda for technology. The deck has revenue per product, ARR growth, and a slide of green uptime tiles: ticketing at 99.95%, the data warehouse at 99.99%, the customer portal at 99.9%. Everyone nods. The assumption underneath that slide is that uptime adds up to resilience, and that a wall of healthy SLAs means the estate is healthy.
It does not, and a director who is now personally accountable cannot do anything with those tiles. They cannot ask a question that the slide answers. There is no number on it they can own.
Why DORA put resilience on the board agenda, with directors accountable
The Digital Operational Resilience Act, EU Regulation 2022/2554, has applied to in-scope financial entities since 17 January 2025. It does not treat ICT risk as a thing the technology team handles and reports upward. It places ultimate accountability for the ICT risk management framework on the management body, and members of that body can be held personally liable for the entity's failure to comply. The board is supposed to define the resilience strategy, approve it, and stay current on the threat landscape, not receive a status update after the fact.
That changes what a board report has to do. A director who can be named in an enforcement action needs to interrogate the posture, not admire it. You cannot interrogate a slide of green tiles. You can only nod at it.
Per-tool uptime versus estate-level resilience posture
Uptime is a measurement of one component answering requests. Resilience is a property of the whole estate under stress: what happens when a shared dependency fails, how fast the business actually recovers, who is exposed while it is down. Those questions cut across tools, and per-tool metrics are blind to exactly the thing that hurts you. Three vendors can each report 99.95% and all three can sit on the same upstream identity provider or the same cloud region. The slide shows three healthy numbers. The reality is one point of failure wearing three logos.
DORA is explicit about this concentration problem. It builds an EU oversight regime for critical ICT third-party providers precisely because regulators concluded that per-entity, per-contract views miss systemic exposure. A board inherited that same blind spot. If your resilience reporting is assembled tool by tool, you are reproducing the failure mode the regulation was written to catch.
The four numbers a board actually needs: concentration, recovery, exposure, evidence
A board can govern four numbers. It cannot govern forty SLA tiles. The job of the CTO is to collapse the estate into a posture the directors can question and own.
- Concentration: how many critical services depend on a single provider, region, or identity root. One figure for the worst single point of failure, not a tile per app.
- Recovery: the measured time to restore the critical business function, tested, not the vendor's contractual RTO. DORA expects significant entities to run threat-led penetration testing at least every three years, so recovery should be an observed number, not a promise.
- Exposure: who and what is affected while a critical service is down, and whether you can name it inside the four-hour window DORA sets for reporting a major incident.
- Evidence: whether you can produce the audit trail behind all of the above on demand, from one record, rather than reconstructing it the week before the examiner arrives.
Producing a defensible resilience view from one operating record
You cannot summarize what you cannot join. The reason the CTO walks in with per-tool tiles is that each tool keeps its own log, its own dependency map, its own incident history, and nobody has stitched them into one estate. The fix is structural, not another dashboard layer that reads forty APIs and hopes they agree. It is one operating record the whole estate hangs off, so concentration, recovery, exposure, and evidence are queries against a single source instead of a manual reconciliation done under deadline.
That is the shape Spot Suite is built around. Every tenant is a Customer Environment with one record that identity, dependencies, incidents, and the audit trail all attach to, so the four numbers a board needs come from one query and one export rather than ten. When a director asks how concentrated the estate is or how long recovery actually took, the answer is already assembled. See how the estate-level posture is structured.