Supply Chain Risk Management, automated for NIS2 & DORA
NIS2 requires it. DORA mandates it. Regulators audit it. StartComply automates your entire supply chain risk management program so you can prove compliance, not just claim it.
Trusted by 100+ organisations across Europe
100+ EU organisations 
NIS2 Article 21 ready 
DORA Chapter V ready 
EU-built, GDPR resident What you need to know about supply chain risk management
- NIS2 Article 21 makes supply chain security a mandatory cybersecurity measure for essential and important entities across the EU.
- DORA Chapter V requires financial entities to maintain a formal ICT third-party risk management framework, including an ICT register, contractual controls, monitoring, and exit strategies.
- Senior management is directly accountable. NIS2 penalties can reach €10M or 2% of global turnover for essential entities.
- Spreadsheets, email threads, and annual questionnaires are no longer enough when auditors expect documented evidence, ownership, follow-up, and continuous monitoring.
- StartComply maps SCRM activities to NIS2 Article 21 and DORA Chapter V in one platform, with one supplier registry, one assessment workflow, and evidence for both frameworks.
Sources: NIS2 Directive, DORA Regulation. Last updated May 2026.
What Is Supply Chain Risk Management?
Supply chain risk management (SCRM) is the systematic process of identifying, assessing, mitigating, and continuously monitoring risks that originate from or travel through your supply chain, including direct suppliers, sub-contractors, technology providers, and any external party whose failure or compromise could disrupt your operations, expose your data, or create regulatory liability.
The goal is not to eliminate supply chain risk. The goal is to understand where your exposure sits, bring it within limits your organisation has defined as acceptable, and demonstrate to regulators and stakeholders that you manage it systematically.
Supply chain risk management covers five broad categories: operational risks, cybersecurity and IT risks, financial risks, geopolitical risks, and compliance and regulatory risks.
You don’t need two separate programs. StartComply maps every supply chain risk management activity simultaneously to NIS2 Article 21 and DORA Chapter V. One assessment. One register. Full evidence for both frameworks.
SCRM is now a legal requirement.
Most tools weren’t built for it.
A documented, evidenced, continuous program
- NIS2 Art. 21: supply chain security as mandatory cyber measure for essential & important entities
- DORA Chapter V: full ICT third-party risk framework, register, exit strategies
- Article 30 contractual provisions — incident SLAs, audit rights, sub-contracting controls
- Continuous monitoring — annual snapshots no longer satisfy the standard
- Documented evidence available on demand for regulators
Penalty exposure: NIS2 essential entities — up to €10M or 2% of global turnover. DORA fines + management liability. Sources: NIS2 Directive, DORA Regulation.
Spreadsheets, email threads, annual questionnaires
- No central supplier inventory — critical vendors scattered across spreadsheets
- No audit trail, no evidence that assessments actually ran
- Missing incident notification SLAs in supplier contracts
- Zero visibility beyond Tier-1 suppliers (Nth-party blind spot)
- Annual assessments that satisfy nobody’s definition of “continuous”
- No escalation path when high-risk findings sit open for months
The audit reality: regulators don’t ask whether you do SCRM — they ask for the evidence. Files, dates, owners, decisions, follow-ups.
Everything your SCRM program needs. Built into one platform.
Supplier Registry and Risk Classification
StartComply gives you one authoritative record of every supplier relationship in scope. Classify by criticality, risk tier, access scope, and service category.
- Full supplier inventory with configurable classification fields
- Criticality scoring: Critical / High / Standard / Low tiers
- DORA Article 28 ICT register ready out of the box
- Automatic import from procurement and ERP systems
Automated Vendor Risk Assessments
Stop chasing suppliers by email. StartComply sends questionnaires automatically, scores responses against your risk model, and requests supporting evidence without manual intervention.
- Automated distribution and follow-up workflows
- NIS2 and DORA-aligned assessment criteria
- Configurable risk scoring per supplier tier
- Evidence collection: ISO 27001, SOC 2, penetration test results
Continuous Monitoring and Compliance Alerts
NIS2 and DORA require ongoing monitoring, not annual snapshots. StartComply monitors your suppliers continuously and updates risk scores automatically when conditions change.
- Real-time threat intelligence feeds
- Financial distress and credit monitoring
- NIS2 (24h) and DORA (4h) incident escalation workflows
- Automatic risk score updates between assessment cycles
Built for Auditors and Priced for NIS2 and DORA Teams
Not all supply chain risk management approaches produce the evidence regulators require. Here’s how StartComply compares.
StartComply was built specifically for European organisations navigating NIS2, DORA, and ISO 27001.
The 5-stage SCRM lifecycle, automated end-to-end
Map your supply chain DORA Art. 28
Build a complete, structured inventory of every supplier, ICT provider, cloud service, and sub-contractor in scope. StartComply imports supplier data from your existing systems and builds a searchable registry — satisfying DORA’s ICT register requirement. Document your supply chain risk management plan structure from this inventory.
Assess risk systematically NIS2 Art. 21
Distribute questionnaires automatically per supplier tier. Responses are scored against configurable risk criteria. Evidence documents are collected and stored. Every assessment generates a structured risk register entry. This is where cyber supply chain risk management obligations under DORA are met.
Prioritize by risk level
Risk scores feed into a prioritized register. StartComply applies your criticality classifications and likelihood × impact model automatically. Every prioritization decision is recorded with its rationale — the audit trail regulators expect.
Track mitigation actions
For every risk above your appetite threshold, StartComply creates a corrective action record with automated escalation. Owner, deadline, status, evidence — all linked back to the originating finding. Explore the full range of supply chain risk mitigation strategies.
Monitor continuously 24h / 4h SLAs
StartComply monitors every supplier on an ongoing basis: cyber threat intelligence, financial health, regulatory status. Risk scores update automatically. Escalation workflows connect directly to your NIS2 (24h) and DORA (4h) reporting obligations. This is what modern SCRM technology enables at scale.
Frequently Asked Questions About Supply Chain Risk Management
What is supply chain risk management and why does NIS2 require it?
Supply chain risk management is the process of identifying, assessing, mitigating, and monitoring risks that originate from external suppliers, technology providers, and sub-contractors. NIS2 Article 21 makes supply chain security a mandatory cybersecurity measure for all essential and important entities in the EU. DORA Chapter V mandates a formal ICT third-party risk management framework for financial entities. Both regulations carry financial penalties and personal management liability for non-compliance.
Does StartComply cover both NIS2 and DORA requirements in one platform?
Yes. StartComply maps every supply chain risk management activity simultaneously to NIS2 Article 21 and DORA Chapter V. You maintain one supplier registry, run one set of assessments, and generate evidence that satisfies both regulatory frameworks. ISO 27001 Clause 8.4 coverage for externally provided processes is included as well.
How long does it take to deploy StartComply?
Most organisations are operational within days. StartComply imports supplier data from existing procurement and ERP systems, arrives with NIS2 and DORA-aligned assessment templates pre-configured, and does not require months of implementation consultancy. You can run your first supplier assessment within the first week of deployment.
What’s the difference between SCRM and TPRM, and does StartComply support both?
SCRM (Supply Chain Risk Management) focuses specifically on the supply chain structure, including multi-tier supplier relationships and cascading failure risk. TPRM (Third-Party Risk Management) is the broader discipline covering all external party risks. StartComply supports both, with tiered vendor management (Tier 1, 2, and 3) built into the platform.
Does StartComply support continuous monitoring, or only periodic assessments?
Both. StartComply runs automated periodic assessments on your defined schedule per supplier tier. Between assessment cycles, continuous monitoring tracks cyber threat intelligence feeds, financial health signals, regulatory status changes, and news alerts for every supplier in your registry. Risk scores update automatically when monitoring signals change.
How does StartComply handle corrective action tracking?
When an assessment identifies a gap, StartComply creates a corrective action record automatically: the specific finding, the required action, the internal owner, the supplier contact, and the deadline. The platform sends automated notifications to suppliers and internal owners. Escalation triggers fire automatically when deadlines approach or pass.
How is StartComply priced compared to enterprise GRC platforms?
StartComply uses flat-rate annual pricing with no per-user fees and all features included, including TPRM and supply chain risk management. Enterprise GRC platforms typically charge per seat with TPRM as an add-on module. StartComply pricing is built for the companies NIS2 and DORA actually apply to, not for Fortune 500 budgets.
Stop Managing Supply Chain Risk with Spreadsheets.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
