How to Build a Supply Chain Risk Management Plan
An SCRM plan is the operational backbone of your supply chain risk program. Under NIS2 and DORA, regulators ask to see it, and its absence is itself a compliance finding. This guide covers what it must contain, how to build it, and how StartComply maintains it automatically.
Trusted by 100+ organisations across Europe
NIS2 Article 21 
DORA Chapter V 
Live Risk Register 
Audit-Ready Evidence What you need to know about an SCRM plan
- An SCRM plan is the live operational record of your supply chain risk program. NIS2 and DORA auditors examine it directly.
- Plan, policy, and process are three different documents. All three must exist. They reference each other.
- A complete SCRM plan has 10 components, with the risk register as its operational core.
- A plan that is not actively used, updated, and acted on fails the first question a competent auditor asks.
- StartComply maintains the SCRM plan automatically: supplier registry, risk register, corrective actions, monitoring signals, all updated continuously.
Sources: NIS2 Directive, DORA Regulation. Last updated May 2026.
Plan vs. Policy vs. Process: The Three Documents You Need
Before building the plan, understand what it is, and what it is not.
The Policy
The policy defines your organisation’s rules and requirements for supply chain risk management. It sets the scope, roles, minimum standards, and the management authority behind the program. Board or senior management must approve it. It is stable and reviewed annually.
The Process
The process defines how your organisation executes SCRM: the step-by-step workflow for identifying, assessing, prioritizing, mitigating, and monitoring supply chain risks.
The Plan
The plan documents the current operational state of your SCRM program: which suppliers are in scope, what risks exist, how you assessed them, what mitigation actions are underway or complete, and where each risk stands right now. It is a live document, updated continuously as the program runs.
All three must exist. Auditors examine all three. They reference each other: the policy requires that a plan be maintained; the plan is built using the process; the process implements the requirements the policy sets.
StartComply maintains all three in one platform: version-controlled policy templates, automated process execution, and a live risk register that constitutes your operational plan.
Practical rule: the policy defines the rules, the process defines the workflow, and the plan shows the current operational state with evidence.
The Ten Components of a Complete SCRM Plan
A working SCRM plan is more than a document. It contains ten components, each with a clear owner, defined evidence, and an update cycle that auditors can verify.
Scope and Objectives
Define exactly what this plan covers: which legal entities, supplier categories, risk types, and geographies are in scope. Explicit exclusions with documented rationale. The scope statement is the first thing an auditor examines.
Risk Appetite Statement
The level of supply chain risk your board or senior management has formally approved. Documented, formal, and visibly owned at management level. Under NIS2 and DORA, management bodies carry personal accountability, risk appetite must be visible at that level, not buried in a working document.
Supplier Inventory and Classification
A complete, maintained record of all supply chain relationships in scope. Each supplier classified by criticality tier, access scope, and service category. Classification drives every downstream decision: assessment frequency, mitigation requirements, monitoring intensity, and contractual expectations.
Risk Assessment Methodology
How risks are assessed consistently: which criteria, which scoring model, how likelihood and impact are determined, who conducts assessments. Consistent enough that different assessors evaluating the same supplier at different times reach comparable conclusions.
Risk Register
The operational heart of the plan. A structured, continuously updated record of all identified risks: supplier, risk description, category, likelihood and impact scores, overall rating, risk owner, mitigation actions with deadlines and status, residual risk, and formal risk decision. StartComply maintains this automatically from assessment outputs.
Mitigation Actions and Corrective Plans
For each risk above threshold: specific actions, internal owner, supplier contact, target completion date, verification method, and current status. StartComply creates corrective action records directly from assessment findings and tracks them to closure with automated escalation.
Monitoring Schedule
How each supplier tier gets monitored, how often, and through which data sources. StartComply’s continuous monitoring runs automatically against your defined schedule per tier.
Incident Response Integration
How supply chain incidents connect to your regulatory notification obligations. Who determines whether a supplier incident crosses NIS2 or DORA reporting thresholds. Internal response timelines must be faster than regulatory deadlines, 24h for NIS2, 4h for DORA classification.
Roles and Responsibilities (RACI)
Who is accountable, responsible, consulted, and informed at each program level. Under NIS2 and DORA, senior management must be personally engaged, the RACI must reflect this, not concentrate all responsibility at operational level.
Review and Update Cycle
How often the plan is reviewed, who reviews it, and what triggers an unscheduled review. Minimum: annual full review plus update after any significant supply chain incident.
Building Your SCRM Plan: Step by Step
Get Management Commitment and Define Risk Appetite Board level
Without management commitment, SCRM is a paper exercise. Under NIS2 and DORA, management bodies carry personal accountability. Start by establishing that accountability explicitly, and by getting formal approval of your risk appetite at board or senior management level.
Build Your Supplier Inventory Supplier registry
Pull supplier data from procurement, IT, legal, and finance. StartComply imports this automatically from existing systems. Establish a maintenance process at the same time, because the plan is only as useful as the data behind it.
Classify Suppliers by Criticality Risk tiering
Apply your classification criteria. Most suppliers will fall into standard or low-risk tiers. A manageable critical tier is what receives intensive management. StartComply’s classification engine applies your criteria automatically.
Conduct Initial Risk Assessments Evidence collection
Start with your critical tier. StartComply distributes assessment questionnaires automatically, scores responses, collects evidence, and populates the risk register with findings.
Define and Assign Mitigation Actions Corrective actions
For each risk above appetite threshold, create specific actions, assign owners, and set deadlines. StartComply generates corrective action records directly from assessment findings and notifies owners automatically.
Set Up Continuous Monitoring Ongoing monitoring
Activate StartComply’s monitoring feeds for your critical and high-risk tiers. Define escalation rules for threshold breaches.
Integrate with Incident Response NIS2 and DORA
Define how supply chain incidents trigger your regulatory notification workflows. Connect StartComply’s escalation alerts to your incident response process.
Document, Approve, and Run the Review Cycle Review cycle
Finalize the plan document, obtain formal management approval, and schedule the first formal review within 12 months. StartComply’s policy management module handles version control and approval workflows. For the underlying process methodology: The Supply Chain Risk Management Process.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
StartComply Turns Your SCRM Plan into a Running Program
Common SCRM Planning Mistakes That Fail Audits
The plan is a document, not a program. Many organisations produce an SCRM plan after an audit finding and file it. A plan that is not actively used, updated, and acted on fails the first question a competent auditor asks: “Can you show me evidence this plan is being followed?”
No defined risk appetite. Without a formal risk appetite statement, there is no principled basis for deciding which risks to mitigate and which to accept. Every risk management decision becomes subjective and inconsistent.
Scope that excludes critical suppliers. Organisations tend to scope SCRM plans around suppliers they are comfortable assessing, not the suppliers that create the most risk. Sub-contractors, ICT providers, and cloud services frequently get excluded.
Mitigation actions without owners or deadlines. A risk register full of actions marked “in progress” with no completion dates is equivalent to no mitigation at all.
No connection to incident response. A supply chain plan that does not define what happens when a supplier has a security incident is incomplete. This is where regulatory exposure is highest.
Audit reality: a plan only proves compliance if it is actively used, updated, assigned, and evidenced.
SCRM Plan Questions: Answered
Is an SCRM plan required by NIS2?
NIS2 requires essential and important entities to implement supply chain security as a mandatory cybersecurity measure. Auditors expect to see systematic, documented supply chain risk management. DORA is more explicit: it requires a documented ICT third-party risk management policy and a register of all ICT arrangements. An SCRM plan provides the operational substance behind both.
How is an SCRM plan different from an SCRM policy?
The policy defines the organisation’s rules and requirements for SCRM, requires management approval, and is relatively stable. The plan is the operational record of the current program state, supplier assessments, risk register, mitigation actions. Both must exist. Neither replaces the other.
How often should an SCRM plan be reviewed?
The risk register within the plan updates continuously as assessments run and actions progress. The overall plan structure gets a formal review at minimum annually, after any significant supply chain incident, and when there is a material change in the supplier base or risk appetite.
What is an SCRM plan template?
A pre-structured document format covering the ten core plan components. A good template accelerates plan development but must be adapted to your specific context. Generic templates adopted without customisation typically fail NIS2 and DORA audit expectations. StartComply’s plan templates are pre-mapped to NIS2 Article 21 and DORA Chapter V requirements.
How does StartComply maintain the SCRM plan automatically?
StartComply’s supplier registry, assessment workflows, and risk register work together as the operational plan. As assessments run, findings populate the risk register automatically. As corrective actions progress, their status updates in the register. As monitoring signals change, risk scores update. The plan stays current without manual maintenance, and every change generates an audit trail entry.
