Third-Party Compliance Risk Management: A Practical Guide
NIS2 requires it. DORA mandates it. Regulators audit it. StartComply automates your third party compliance risk management workflow, from initial vendor assessment through to audit-ready evidence packs.
Trusted by 100+ organisations across Europe
NIS2 
DORA 
ISO 27001:2022 
TPRM What you need to know about third party compliance risk management
- Third party compliance risk management is a legal obligation under NIS2 Article 21 and DORA Article 28, not a voluntary best practice.
- Essential entities under NIS2 face fines of up to €10 million or 2% of global annual turnover for supply chain security failures.
- DORA Article 30 specifies mandatory contractual clauses for ICT third-party arrangements. Missing clauses are a direct regulatory breach.
- Annual vendor reviews do not satisfy NIS2 or DORA. Continuous monitoring is mandatory for defensible oversight.
- The most common audit findings are incomplete vendor inventories, stale assessment evidence, and missing contractual clauses.
- Third party compliance management and broader third party risk management should be integrated, but they serve different operational purposes.
- Automation is the practical way to run a continuous, audit-ready programme at scale.
Last updated May 2026.
Third-Party Compliance Is a Legal Requirement
A documented, evidenced, continuous third party compliance programme
- NIS2 Article 21: manage supply chain security, including supplier and service provider security practices
- DORA Article 28: maintain a complete ICT third-party register and regularly review ICT third-party risk strategy
- DORA Article 30: verify mandatory ICT contract clauses, including audit rights and incident obligations
- ISO 27001:2022 Annex A 5.19-5.22: document, monitor, and review supplier relationships affecting information security
- Evidence on demand: dates, owners, decisions, monitoring records, corrective actions, and contract checks
Penalty exposure: NIS2 essential entities face up to €10M or 2% of global turnover. Important entities face up to €7M or 1.4%. Sources: NIS2 Directive, DORA Regulation.
Spreadsheets, annual questionnaires, shared drives, and email threads
- Incomplete vendor inventories, especially shadow IT and departmental purchases
- Stale assessment evidence and expired certifications that nobody noticed
- Missing DORA Article 30 clauses in legacy ICT provider contracts
- No automated trigger when vendor incidents require internal escalation
- No evidence trail showing who reviewed what, when, and what action followed
- No separation between compliance findings, operational risk, and contractual remediation
The audit reality: regulators do not ask whether you run vendor reviews. They ask for files, dates, owners, decisions, follow-ups, and proof that monitoring is ongoing.
Everything Your Third-Party Compliance Programme Needs
Inventory and Regulatory Classification
Build one authoritative register of every vendor, supplier, ICT provider, service provider, and partner in scope. Classify each third party by regulation, data access, service criticality, and compliance exposure.
- Complete vendor inventory with ownership, legal entity, service category, and access scope
- DORA Article 28 ICT third-party register structure
- NIS2 supply chain security scope mapping
- GDPR, ISO 27001, and sector-specific compliance flags
Risk-Tiered Due Diligence and Onboarding
Replace generic 200-question questionnaires with focused assessments mapped to each vendor’s real exposure. StartComply routes the right questionnaire, requests evidence, scores responses, and stores the result against the relevant obligation.
- Risk-tiered onboarding for critical, high, standard, and low-risk third parties
- Assessment templates mapped to NIS2, DORA, GDPR, and ISO 27001 controls
- Certification and audit report collection, including ISO 27001 and SOC 2
- Automated reminders, escalations, and reviewer workflows
Contractual Compliance and Clause Tracking
DORA Article 30, NIS2, and GDPR require specific contractual protections. StartComply helps compliance and legal teams verify whether mandatory clauses are present before contracts are executed or renewed.
- Mandatory clause tracking for audit rights, security requirements, incident notifications, and termination provisions
- Pre-approved clause libraries mapped to regulatory requirements
- Legacy contract gap identification and remediation workflows
- Evidence that mandatory clauses were reviewed, approved, and actioned
Continuous Monitoring and Incident Escalation
Annual reviews are not enough. StartComply monitors third party compliance changes across the contract lifecycle and triggers action when certifications lapse, risk signals change, or vendor incidents affect your organisation.
- Continuous monitoring for certification status, security incidents, subcontractor changes, and material service changes
- NIS2 24-hour and 72-hour incident response escalation support
- Automatic re-assessments when thresholds or risk conditions change
- Evidence packs mapped to each regulatory article and audit request
StartComply vs. The Alternatives
Most third party compliance approaches can collect information. Far fewer can prove continuous regulatory oversight when an auditor asks for evidence.
StartComply is built for European compliance teams that need third party oversight to be structured, evidenced, and regulator-ready, without the cost and complexity of traditional enterprise GRC.
What Third Party Compliance Risk Management Actually Means
Third party compliance risk management is the structured process of identifying, assessing, and continuously monitoring whether vendors, suppliers, ICT providers, service providers, and partners meet the legal and regulatory obligations your organisation is bound by.
Compliance risk in a third party context is not only about whether a vendor holds an ISO 27001 certificate. It is about whether that vendor’s controls remain operational, whether subcontractors introduce additional exposure, and whether gaps in their compliance posture create regulatory liability for your organisation.
A complete programme covers four activities: scoping which third parties fall under which regulations, assessing compliance posture at onboarding, monitoring for changes during the contract lifecycle, and producing evidence that satisfies regulators if asked. To connect this page to the broader discipline, review what is third party risk management and how compliance risk fits inside it.
You do not need separate vendor programmes. StartComply lets compliance teams run NIS2, DORA, GDPR, and ISO 27001 tracks inside one third party risk workflow, while keeping separate evidence for each obligation.
How to Structure a Third Party Compliance Risk Management Programme
Identify every third party DORA Art. 28
Build a complete inventory of all vendors, suppliers, service providers, ICT providers, and partners. Classify each by regulation, data access, service criticality, and the type of compliance exposure it creates. You cannot evidence oversight for vendors that never made it into the register.
Run due diligence at onboarding NIS2 Art. 21
Assess each vendor’s compliance posture before onboarding. Use questionnaires mapped to specific regulatory requirements, review certifications and audit reports, and document the result in a structured risk record. Risk-tiered onboarding keeps assessments proportionate and defensible.
Verify mandatory clauses DORA Art. 30
Check that contracts contain the clauses required by regulation, including audit rights, security requirements, data handling provisions, incident notification timelines, and termination rights. Missing mandatory clauses are a direct audit finding, not just a contract preference.
Track compliance throughout the contract lifecycle Continuous oversight
Monitor certification status, published security incidents, subcontractor changes, service changes, and contractual thresholds. Trigger re-assessments when material changes occur instead of waiting for the next annual review.
Connect vendor incidents to response workflows NIS2 / DORA incidents
When a third party incident affects your organisation, internal timelines start immediately. Vendor notifications should trigger compliance, security, legal, and management escalation automatically, with clear evidence of every decision.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Third Party Compliance Risk Management
What regulations require third party compliance risk management in Europe?
Three main frameworks drive third party compliance obligations for European organisations. NIS2 Article 21 requires essential and important entities to manage supply chain security risks, including supplier security practices. DORA Article 28 requires financial entities to maintain a complete register of ICT third-party providers and adopt a formal ICT third-party risk strategy. ISO 27001:2022 Annex A controls 5.19 to 5.22 require documented and monitored supplier relationship management. Each regulation maps to different evidence inside your vendor programme.
How often should third party compliance assessments be conducted?
Annual assessments are a minimum baseline, not a complete programme. NIS2 and DORA both require continuous monitoring of third party risks, not point-in-time snapshots. In practice, this means onboarding assessments, triggered re-assessments when services, subcontractors, or incidents change the risk profile, and at least annual full reviews for critical vendors. Critical ICT providers should be reviewed more frequently.
What is the difference between third party risk management and compliance management?
Third party risk management covers all risks from your supply chain, including operational, financial, reputational, cyber, and compliance risks. Third party compliance risk management focuses specifically on whether vendors meet regulatory and contractual obligations, and whether your organisation can evidence that oversight to regulators or auditors. The two programmes should be integrated into one register, but they trigger different remediation workflows.
What contractual clauses are mandatory for ICT vendors under DORA?
DORA Article 30 requires contracts with ICT third-party service providers to include clear service descriptions and service levels, data location and portability provisions, explicit audit rights, incident response support, notification obligations, and termination provisions. Contracts signed before DORA came into application often lack these clauses. Legacy contracts must be remediated as part of ongoing third party compliance management.
What fines apply for failing to manage third party compliance risks under NIS2?
NIS2 fines depend on entity classification. Essential entities face maximum fines of €10 million or 2% of total global annual turnover, whichever is higher. Important entities face maximum fines of €7 million or 1.4% of total global annual turnover. These fines apply across NIS2 Article 21 obligations, including supply chain security. Management accountability is also explicit under the directive.
Can spreadsheets support a compliant third party risk programme?
Spreadsheets cannot support a programme that satisfies NIS2 or DORA requirements at meaningful scale. They do not alert you when certifications lapse, do not trigger re-assessments automatically, and do not produce audit-ready evidence mapped to specific regulatory articles. For programmes covering more than a small vendor base, continuous monitoring breaks first.
Stop Managing Third Party Compliance Risk with Spreadsheets.
Which Regulations Drive Third Party Compliance Requirements?
Third party compliance obligations are not identical across frameworks. NIS2 focuses on supply chain security for essential and important entities. DORA focuses on ICT third-party risk for financial entities. ISO 27001 requires supplier relationship controls to be documented, monitored, and reviewed.
The practical result is simple: one vendor register can support the programme, but each regulation needs its own evidence trail.
ISO 27001:2022 Annex A controls 5.19 to 5.22 add another layer: supplier relationships affecting information security must be documented, agreed, monitored, reviewed, and managed when services change.
Third Party Compliance Timeline: Where Things Stand Now
NIS2 transposition deadline. Member states were required to bring NIS2 into national law, expanding supply chain security expectations across essential and important entities.
DORA became applicable for EU financial entities. ICT third-party risk management, register maintenance, and contract clause obligations moved from preparation to live compliance.
ISO 27001:2022 certification and surveillance audits continue testing whether supplier management controls are operational, evidenced, reviewed, and updated when services change.
Supervisory authorities and auditors are increasingly focusing on vendor inventories, stale assessments, contractual gaps, and whether continuous monitoring is actually happening.
Enforcement risk is live. Organisations still relying on spreadsheets and annual questionnaires are carrying active exposure because they cannot prove continuous third party oversight.
Handling ICT providers? DORA Article 28 register obligations and Article 30 contract checks should already be operational. Legacy contracts, missing audit rights, and incomplete provider lists are priority remediation areas.
Common Gaps That Regulators Find
Supervisory inspections and certification audits repeatedly find the same problems in third party compliance programmes. Closing these gaps early turns audit preparation from a fire drill into a controlled process.
Incomplete vendor inventory
Shadow IT, departmental purchases, acquired entities, and untracked ICT providers leave gaps in the register. Under DORA Article 28, incomplete means non-compliant.
Stale assessment evidence
Onboarding assessments that were never refreshed, expired certifications, and outdated audit reports tell auditors that monitoring is not working.
Missing contractual clauses
Legacy contracts often pre-date NIS2 or DORA and lack mandatory provisions, especially audit rights, incident notifications, and termination controls.
No continuous monitoring
Annual reviews do not track certification lapses, new subcontractors, service changes, or published vendor incidents as they happen.
Weak incident escalation
Vendor incident notifications must trigger internal response workflows immediately. Waiting for an account manager email is not a defensible process.
No evidence mapped to obligations
Files stored in shared drives do not show which regulatory article each assessment, contract review, or monitoring action satisfies.
