Almost every executive calls digital resilience a strategic priority. Yet when software is selected, price, functionality and speed of implementation still win out over that ambition remarkably often.
The problem
In the selection matrix, digital resilience is often reduced to little more than a tick box.
Why Finance?
The CFO safeguards the total value of the business, and technology is increasingly the key to the vault.
The advice
Add 5 questions on data, access, continuity, dependency and exit options, and ask for demonstrable evidence.
Almost every executive regards digital resilience as a strategic priority. Cyber risks are on the agenda, organisations are preparing for NIS2 and AI governance is getting more attention too. But when it comes to selecting software, functionality, speed of implementation and price turn out to win out over that ambition remarkably often.
I recognise that pattern in many organisations. In boardroom discussions, digital resilience is high on the agenda, but in the final selection matrix it is often reduced to little more than a tick box.
That is understandable: costs and functionality can be compared directly, while digital dependencies are harder to express in euros. Yet it is precisely those dependencies that can affect an organisation's continuity and value.
Look beyond the purchase price
This is where Finance has a broader responsibility. The CFO safeguards not only what is in the treasury, but also the total value of the business. Technology provides access to processes, data and decision-making. That makes technology increasingly the key to the vault.
Anyone who wants to protect that value therefore has to look beyond the purchase price and the expected return. Where is our data stored? Who has access to it? How is continuity ensured? How dependent will we become on this supplier? And can we transfer our data and processes in a controlled way if the partnership ends?
Relying on a promise is not enough. Ask suppliers how they demonstrate their resilience. Are security, back-ups and recovery procedures tested independently? Are responsibilities for subcontractors clear? And is there a workable exit plan?
This is not a plea to automatically choose a European supplier. A European head office is no guarantee of security. European suppliers do, however, operate within European legal and supervisory frameworks. With providers from outside the EU, other legal systems and international data flows may also come into play. That belongs in the assessment too.
From tick box to full criterion
My advice for your next software selection is simple: alongside price, functionality and implementation time, add 5 questions on data, access, continuity, dependency and exit options. Then ask for demonstrable evidence, not just a confirming answer.
Not every risk has to be decisive. But a risk that is not made visible cannot be consciously accepted either.
Anyone who calls digital resilience strategic should therefore make it visible in the selection criteria, the business case and the contract. Only then do we truly buy according to what we say we value.
Read also: NIS2, AI governance and digital resilience: why Finance is playing a bigger role
This article was originally published in Dutch on CMweb.
Gustaf Tanate
Gustaf Tanate is CEO of ISPnext. Drawing on his experience in technology, cloud solutions and digital transformation, he follows developments at the intersection of Finance, governance and innovation. In his columns, he shares practical insights into the role of technology in strategic decision-making.
Staying in control of compliance and digital resilience?
Read our whitepaper to learn how financial organisations can achieve compliance with DORA, the EU regulation on digital operational resilience, in four steps.
.png)
