Third-Party Risk Management (TPRM): The Complete Guide
NIS2 requires it. DORA mandates it. Regulators audit it. StartComply automates your entire third party risk management lifecycle, from vendor onboarding and risk scoring through to continuous monitoring and audit-ready evidence.
Trusted by 100+ organisations across Europe
NIS2 DORA 
ISO 27001:2022 
TPRM What you need to know about third party risk management
- Third party risk management is a legal obligation under NIS2 Article 21 and DORA Articles 28 and 30, not an optional best practice.
- A TPRM framework must cover vendor inventory, risk tiering, due diligence, contractual controls, continuous monitoring, and exit procedures.
- Continuous monitoring is mandatory. Annual questionnaires do not meet the standard set by NIS2 or DORA.
- Cyber risk from third parties includes supply chain attacks, fourth-party exposure, and lateral movement through vendor access.
- DORA Article 30 sets minimum contractual requirements for ICT contracts, including audit rights, incident notification clauses, and termination rights.
- Compliance risk includes GDPR data processing obligations, sector-specific certifications, and sub-processing controls.
- Vendor incident notification clauses must require disclosure timelines short enough for your own 24-hour and 72-hour regulatory deadlines.
Sources: NIS2 Article 21, DORA Articles 28 and 30, GDPR Article 28. Last updated May 2026.
TPRM is now mandatory. Most teams are still stuck in spreadsheets.
A documented, evidenced, continuous TPRM programme
- NIS2 Article 21: supply chain security as a mandatory cybersecurity measure
- DORA Article 28: ICT third-party register and risk assessments before engagement
- DORA Article 30: contractual provisions covering audit rights, incident reporting, termination, and sub-contracting
- GDPR Article 28: data processing agreements and sub-processor controls
- Continuous monitoring, escalation workflows, and audit-ready evidence on demand
Penalty exposure: NIS2 essential entities can face fines of up to €10M or 2% of global annual turnover. DORA adds supervisory sanctions for financial entities. Sources: NIS2 Directive, DORA Regulation.
Spreadsheets, annual questionnaires, and blind faith
- Vendor inventories split across procurement, finance, legal, and IT spreadsheets
- Annual questionnaires that miss real-time cyber, financial, and compliance changes
- No consistent risk tiering for critical, significant, and standard vendors
- Missing or inconsistent incident notification clauses in vendor contracts
- Little visibility into fourth-party subcontractors and concentration risk
- No immutable audit trail showing who assessed a vendor, when, and why
The audit reality: regulators do not ask whether you have a TPRM policy. They ask for evidence: vendors, dates, owners, decisions, controls, incidents, and follow-ups.
Everything Your TPRM Programme Needs. Built Into One Platform.
Vendor Inventory and Risk Classification
StartComply gives you one authoritative register for every external party that touches your systems, data, or operational processes. Build a complete view of third party exposure without chasing spreadsheets across departments.
- Central vendor inventory across procurement, IT, legal, and compliance
- Configurable risk tiers: critical, significant, standard, and low risk
- Classification by access scope, data category, service type, and business criticality
- DORA-ready ICT third-party register structure for financial entities
Automated Due Diligence and Onboarding
Stop managing vendor onboarding through email chains. StartComply distributes questionnaires, collects evidence, scores responses, and routes approvals so due diligence happens before vendors go live.
- Automated questionnaires by vendor tier and service category
- Evidence collection for ISO 27001, SOC 2, penetration tests, and policies
- Financial stability, sanctions, subcontractor, and compliance checks
- Timestamped approval workflows with full audit history
Continuous Monitoring and Escalation
Annual questionnaires do not catch vendor breaches. StartComply monitors risk signals continuously, updates risk scores, and triggers escalation workflows when a vendor’s posture changes. That gives your team real-time risk visibility, not annual snapshots.
- Cyber, compliance, financial, and operational monitoring signals
- Automatic alerts when vendor risk exceeds defined thresholds
- NIS2 and DORA incident escalation workflows for third party events
- Corrective action tracking with owners, due dates, and evidence
StartComply vs. The Alternatives
Not every third party risk management approach produces the evidence that NIS2, DORA, GDPR, and auditors expect. Spreadsheets record activity. StartComply operationalises it.
StartComply was built for European compliance teams that need operational TPRM evidence, not another spreadsheet that has to be cleaned before every audit.
What Is Third Party Risk Management?
Third party risk management (TPRM) is the systematic process of identifying, assessing, mitigating, and continuously monitoring risks that originate from or travel through your vendors, suppliers, and service providers. It covers every external party that has access to your systems, data, or operational processes.
The scope is broader than most compliance teams initially assume. Third parties include cloud providers, IT subcontractors, professional services firms, and supply chain partners that could affect your ability to operate, protect data, or meet legal obligations.
A mature TPRM programme covers six core components: vendor inventory, risk classification, due diligence, contractual controls, ongoing monitoring, and exit planning. The goal is not to eliminate every risk. The goal is to understand exposure, reduce it to an acceptable level, and prove that the programme works.
You own the risk. Regulators do not allow organisations to disclaim responsibility because the incident started at a vendor. If the third party affects your systems, data, customers, or regulated services, your evidence matters.
How StartComply Manages Third Party Risk in Five Steps
Build a complete vendor inventory DORA Art. 28
Capture every vendor, SaaS platform, ICT provider, subcontractor, and service provider in one structured register. Each record includes ownership, service scope, access type, data category, and business criticality so your team can see the full vendor population.
Apply risk tiering consistently NIS2 Art. 21
Classify vendors by risk tier, system access, data sensitivity, operational dependency, and regulatory relevance. Risk tiering determines assessment depth, reassessment cadence, contractual requirements, and approval routing.
Run due diligence before go-live Pre-engagement control
Distribute questionnaires, request evidence, evaluate financial and compliance signals, and document subcontractor exposure before contracts are signed. Every decision is captured with a timestamped audit trail.
Track cyber, compliance, and operational changes Continuous monitoring
Monitor vendors between formal assessment cycles. Alerts trigger when risk scores deteriorate, incidents occur, contracts need review, or corrective actions sit open beyond agreed deadlines.
Control exit risk and close evidence gaps Exit planning
Revoke access, confirm data deletion or return, collect final evidence, close open findings, and document the offboarding decision. Vendor exit becomes a controlled process, not an afterthought.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Third Party Risk Management
What regulations require third party risk management in Europe?
NIS2 Article 21 requires essential and important entities to implement supply chain security measures as a mandatory obligation. DORA Articles 28 and 30 require financial entities to conduct pre-engagement risk assessments, maintain a vendor register, and include minimum contractual clauses in ICT contracts. GDPR Article 28 requires data processing agreements with vendors that process personal data. Together, these frameworks make TPRM a legal requirement for regulated sectors.
What is the difference between TPRM and vendor management?
Vendor management covers the commercial and operational supplier relationship: contracts, performance, cost, and service levels. Third party risk management focuses on the risk dimension: what could go wrong with the vendor, how severe the impact would be, and how the organisation detects and responds. TPRM is a risk and compliance function that produces evidence for regulators, not just KPIs for the business.
How often should we reassess third party vendors?
Reassessment frequency should be proportionate to risk tier. Critical vendors require continuous monitoring with at least annual formal reassessment. Significant vendors typically require semi-annual or annual review. Standard vendors may need reassessment when scope changes. The key point is that NIS2 and DORA expect continuous monitoring, not only point-in-time questionnaires.
What happens if we fail to comply with third party risk requirements under NIS2?
Non-compliance with NIS2 supply chain risk requirements can result in fines of up to €10 million or 2% of global annual turnover for essential entities, whichever is higher. Important entities face fines of up to €7 million or 1.4% of global annual turnover. Authorities may also impose binding instructions, require audits, and in serious cases suspend authorisations. NIS2 also includes management body accountability.
What is fourth-party risk and do we need to manage it?
Fourth-party risk is the risk carried by your vendors’ own suppliers and subcontractors. If a critical cloud provider relies on a subcontractor for data centre operations and that subcontractor suffers a breach, your operations and data may be affected. DORA requires financial entities to assess concentration risk from subcontractors supporting critical ICT services, so contractual disclosure of critical subcontractors is essential.
Can we use a spreadsheet to manage third party risk?
A spreadsheet cannot meet continuous monitoring expectations, cannot produce reliable timestamped audit trails, cannot auto-escalate alerts, and cannot scale as vendor volume grows. Regulators expect evidence, not declarations. A spreadsheet updated manually once a year demonstrates an administrative exercise, not an operational TPRM programme. StartComply produces audit-ready evidence by default.
Stop Managing Third Party Risk with Spreadsheets.
Which Regulations Make TPRM Mandatory in Europe?
Third party risk management is driven by overlapping European regulatory obligations. NIS2 makes supply chain security a mandatory cybersecurity measure. DORA requires formal ICT third-party risk management for financial entities. GDPR requires processor controls when vendors handle personal data. Together, they turn vendor risk into a documented compliance obligation.
Regulatory overlap matters. The same vendor may create NIS2, DORA, GDPR, operational resilience, and cyber exposure at the same time. StartComply maps evidence once and reuses it across frameworks.
The Third Party Risk Management Workflow
A business owner requests a new vendor. StartComply captures service scope, system access, data category, and operational dependency before the vendor enters the approval flow.
The vendor is tiered by criticality, data sensitivity, ICT relevance, and business impact. The risk tier determines assessment depth and contractual requirements.
Questionnaires, evidence requests, financial checks, sanctions screening, security reviews, and subcontractor mapping run before contract signature and go-live.
Continuous monitoring tracks risk signals, incidents, corrective actions, contract obligations, audit rights, and reassessment deadlines throughout the vendor relationship.
Access is revoked, data return or deletion is evidenced, open findings are closed, and the final vendor record is preserved for audit.
For financial entities:
DORA requires ICT third-party risk management to start before engagement, continue during the relationship, and remain evidenced through exit. Contractual clauses, audit rights, sub-contracting controls, and termination rights must be built into the workflow.
The 6 Components of a Complete TPRM Framework
A working TPRM framework is more than a policy. It is a structured operating model with clear owners, defined risk tiers, evidence requirements, monitoring triggers, and exit controls.
Vendor inventory
A complete, current register of every vendor, ICT provider, SaaS platform, subcontractor, and service provider in scope, including ownership and access details.
Risk classification
Documented tiering criteria that determine assessment depth, approval routing, reassessment cadence, and contractual protections.
Due diligence
Pre-engagement assessment of cyber controls, financial stability, compliance status, subcontractors, certifications, policies, and operational resilience.
Contractual controls
Required clauses for audit rights, incident reporting, data location, sub-processing, performance levels, termination rights, and exit support.
Continuous monitoring
Ongoing cyber, compliance, financial, and operational monitoring that updates risk scores and escalates issues between formal reassessments.
Exit planning
Documented offboarding procedures for access revocation, data deletion or return, asset recovery, final evidence, and closure of open findings.
