Third-Party Cyber Risk Management: Protect Your Organization
Every SaaS tool, managed service, cloud integration, and ICT provider can become an attack vector. StartComply automates the full third party cyber risk lifecycle, from vendor onboarding questionnaires to continuous monitoring and audit-ready evidence.
Trusted by 100+ organisations across Europe
NIS2 Article 21 
DORA Articles 28-30 
Cyber Risk 
TPRM What you need to know about third party cyber risk management
- Third party cyber risk management is a mandatory legal obligation under NIS2 Article 21 and DORA Articles 28 to 30, not a recommended practice.
- Every vendor with access to systems or data must be inventoried, tiered by cyber criticality, and assessed proportionately.
- Continuous monitoring is what separates a credible programme from a static annual questionnaire exercise.
- DORA Article 30 requires specific contractual provisions in ICT third-party agreements, including audit rights and incident notification obligations.
- NIS2 penalties for essential entities can reach €10 million or 2% of global annual turnover.
- Documentation must be audit-ready in advance, not reconstructed when a regulator asks for it.
- StartComply centralises vendor records, assessment outputs, contract controls, monitoring signals, remediation workflows, and evidence in one platform.
Sources: NIS2 Directive, DORA Regulation. Last updated May 2026.
Third-Party Cyber Risk Is a Legal Obligation
A documented, monitored, evidence-backed programme
- NIS2 Article 21: supply chain security included in mandatory cyber risk management measures
- DORA Article 28: ICT third-party risk management policy and register of information
- DORA Article 29: pre-contractual assessment before ICT service provider onboarding
- DORA Article 30: mandatory contractual provisions, including audit rights and incident notification
- Continuous monitoring that goes beyond static annual assessments
Penalty exposure: NIS2 fines reach €10 million or 2% of global annual turnover for essential entities. DORA adds supervisory enforcement and management accountability for financial entities.
Spreadsheets, self-reporting, and point-in-time checks
- Incomplete vendor inventory across procurement, IT, legal, and business teams
- No tiering by cyber criticality, data access, integration scope, or business function
- Annual questionnaires with no continuous monitoring signals
- Missing audit rights, incident notification terms, and data deletion provisions
- No structured workflow for vendor-originated incidents
- Evidence scattered across emails, shared drives, and outdated trackers
The audit reality: regulators do not ask whether you have a cyber risk policy. They ask for vendors, dates, controls, evidence, owners, decisions, and follow-ups.
Everything Your Third-Party Cyber Risk Programme Needs
Vendor Inventory and Cyber Tiering
StartComply gives you one structured record of every vendor, supplier, SaaS tool, cloud integration, managed service, and ICT provider in scope. Classify each relationship by cyber exposure, access level, data sensitivity, and operational criticality.
- Central vendor inventory across procurement, IT, legal, and business teams
- Critical, important, and standard vendor tiers
- Classification by system access, data access, integration type, and service category
- DORA ICT register fields structured from the start
Automated Security Questionnaires and Evidence Requests
Stop chasing vendors manually. StartComply sends the right questionnaire based on risk tier, follows up automatically, scores responses, and requests supporting evidence where cyber exposure justifies deeper review.
- Automated questionnaire workflows for onboarding and reassessment
- Evidence collection for ISO 27001, SOC 2 Type II, penetration tests, and security policies
- Risk scoring aligned to NIS2 and DORA expectations
- Overdue response tracking and escalation workflows
Contractual Security Controls
Cyber-critical vendor agreements need more than standard commercial terms. StartComply tracks whether each contract includes audit rights, incident notification obligations, data portability, data deletion, and subcontracting controls.
- DORA Article 30 controls mapped to each ICT provider agreement
- Contract evidence stored against the vendor record
- Missing clause flags for legal and compliance teams
- Termination, exit, and data deletion evidence captured centrally
Continuous Monitoring and Cyber Alerts
A questionnaire gives a snapshot. StartComply helps maintain an ongoing view of vendor cyber risk through periodic reassessments and alert-driven monitoring for changes in risk posture.
- Continuous monitoring signals for critical and important vendors
- Breach disclosures, adverse news, regulatory actions, and ownership changes
- Security rating changes and risk score updates between assessment cycles
- Review cadence by criticality tier
Incident Response and Remediation Tracking
When a third party suffers a breach, your incident clock still runs. StartComply connects vendor findings, incident workflows, owners, deadlines, and remediation evidence so cyber risk work reduces risk instead of producing paperwork.
- Third party incident workflows aligned to NIS2 notification timelines
- High-severity finding ownership and due dates
- Remediation confirmation and evidence upload
- Escalation when critical findings remain unresolved
StartComply vs. The Alternatives
Third party cyber risk management only works when the process produces evidence. The difference is not whether a spreadsheet can list vendors. It is whether your programme can prove who was assessed, when, against what, and what changed.
StartComply was built for European organisations that need third party cyber risk evidence aligned to NIS2, DORA, and ISO 27001, without a months-long enterprise GRC implementation.
What Is Third Party Cyber Risk Management?
Third party cyber risk management is the process of identifying, assessing, mitigating, and continuously monitoring the cybersecurity risks that arise from vendors, suppliers, SaaS platforms, cloud services, managed service providers, and other external parties that access your systems or data.
It is the cybersecurity-specific part of third party risk management. Vendor risk also covers financial stability, business continuity, reputational exposure, and regulatory risk. Cyber risk focuses on the confidentiality, integrity, and availability of your systems and data when a third party is involved.
A credible programme covers the full lifecycle: pre-contract due diligence, cyber criticality tiering, security assessments, evidence collection, contractual protections, continuous monitoring, incident response integration, remediation tracking, and offboarding with data deletion evidence.
Annual questionnaires are not enough. A vendor that passed eighteen months ago may have suffered a breach, changed controls, switched subprocessors, or become more critical to your operations. Regulators increasingly expect an ongoing view of risk.
How StartComply Runs Third Party Cyber Risk in Five Steps
Build the inventory Foundation
Scope every vendor, supplier, SaaS tool, cloud provider, managed service, and ICT third-party service provider that can affect your systems, data, or operations. StartComply turns scattered procurement, IT, and legal inputs into a single authoritative vendor record.
Categorise cyber criticality Risk-based
Classify vendors by access to sensitive systems, data processing role, integration depth, business criticality, and substitutability. Critical, important, and standard tiers determine assessment depth, monitoring cadence, and escalation requirements.
Run security due diligence NIS2 Art. 21
Distribute questionnaires automatically, request supporting evidence, and score vendor responses against your cyber risk criteria. Critical vendors receive deeper review, including security controls, incident history, subprocessor arrangements, and continuity capabilities.
Track contractual protections DORA Art. 30
Map security requirements, audit rights, incident notification obligations, data portability, deletion rights, and subcontracting provisions to each cyber-critical contract. Missing clauses become visible before they become audit findings.
Maintain an ongoing risk view Continuous
Combine scheduled reassessments with continuous monitoring signals, remediation workflows, and incident response integration. StartComply keeps the programme alive between formal assessments, with evidence available on demand.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Third Party Cyber Risk Management
What is third party cyber risk management and why does it matter?
Third party cyber risk management is the systematic process of identifying, assessing, and continuously monitoring the cybersecurity risks that arise from vendors, suppliers, and service providers. It matters because attackers routinely target organisations through weaker third parties to reach more valuable systems and data. Under NIS2 and DORA, European organisations are legally obliged to manage these risks with audit-ready evidence.
Which EU regulations require third party cyber risk management?
NIS2 Article 21(2)(d) mandates supply chain security measures for essential and important entities. DORA Articles 28 to 30 require financial entities to maintain an ICT third-party risk management policy, conduct pre-contractual assessments, include specific security provisions in contracts, and maintain a register of ICT third-party service providers. Both frameworks require evidenced programmes, not just policy documents.
How often should I reassess my vendors’ cyber risk posture?
Reassessment frequency should be proportionate to vendor criticality. Critical vendors should be reassessed at least annually, with more frequent reviews for providers supporting essential functions. Automated monitoring can provide early warning signals between formal assessments, tracking breach disclosures, adverse news, regulatory actions, and security rating changes. Static annual checks are increasingly insufficient where continuous risk management is expected.
What contractual provisions does DORA require for ICT third-party agreements?
DORA Article 30 specifies minimum contractual requirements including clear service descriptions, service level targets, data security and access provisions, incident notification obligations, audit rights for the financial entity and regulators, data portability and deletion rights on termination, and provisions addressing subcontracting. Vendor standard terms are rarely enough to satisfy DORA Article 30.
What is the difference between third party risk management and third party cyber risk management?
Third party risk management is the broader discipline covering financial, operational, reputational, regulatory, and cybersecurity risk across vendor relationships. Third party cyber risk management is the cybersecurity-specific subset, focused on confidentiality, integrity, and availability of data and systems when a third party is involved. For NIS2 and DORA compliance, cyber risk exposure is one of the most important dimensions to evidence.
How do I build a vendor inventory if I do not know all my vendors?
Start with procurement or accounts payable records, your IT asset management system, and your GDPR data processing agreements register. Cross-reference all three to reveal vendors that procurement knows about but IT does not, or processors legal has recorded but procurement has not classified. Then require IT and procurement sign-off for new vendor onboarding so the inventory stays current as a living control.
Stop Managing Vendor Cyber Risk with Spreadsheets.
Which Vendors Need Cyber Risk Assessment?
Not every vendor carries the same cyber risk. A stationery supplier does not need the same level of review as a cloud provider with API access to core systems. The practical goal is proportionate control: deeper assessment where exposure is high, lighter checks where exposure is low.
StartComply helps classify third parties into cyber risk tiers so assessment depth, contract requirements, and monitoring cadence match the actual exposure:
Tiering is the first operational control. Without it, teams either over-assess low-risk vendors or miss the vendors that can cause real cyber and regulatory exposure.
Third Party Cyber Risk Compliance Timeline: Where Things Stand Now
NIS2 transposition deadline. Supply chain security under Article 21 became a national-level cybersecurity obligation for essential and important entities across the EU.
DORA became applicable for financial entities. Articles 28 to 30 introduced operational requirements for ICT third-party risk management, registers, pre-contract assessments, and contractual provisions.
Supervisory expectations shifted from policy ownership to operational evidence. Programmes based only on annual questionnaires and spreadsheets became harder to defend.
Regulators expect organisations to demonstrate vendor inventories, cyber criticality tiering, security assessments, contractual controls, monitoring cadence, and remediation evidence.
Third party cyber risk management should already be operational. If evidence has to be reconstructed when a supervisor asks, the programme is not audit-ready.
Financial entity? Your DORA ICT third-party register, Article 30 contract controls, exit planning, and ongoing provider monitoring should be available before supervisory review, not assembled afterwards.
The 10 Components of an Operational Third Party Cyber Risk Programme
A working programme is more than a questionnaire library. It needs structured ownership, defined cadence, proportionate controls, and evidence that can be produced when regulators, auditors, or senior management ask.
Vendor inventory
A complete list of vendors, suppliers, SaaS tools, ICT providers, and service providers that touch systems, data, or essential functions. The inventory is the foundation of the programme.
Cyber criticality tiering
A risk-based tiering model that classifies vendors by data access, system access, integration scope, business criticality, substitutability, and concentration risk.
Pre-contract security due diligence
Risk-based onboarding assessments before a vendor receives access to systems or data, including control questions, incident history, and continuity capability review.
Evidence collection
Supporting documentation such as ISO 27001 certificates, SOC 2 Type II reports, penetration test summaries, security policies, and business continuity evidence.
Contractual security provisions
Security requirements, audit rights, incident notification obligations, data portability, data deletion rights, and subcontracting controls tracked against each cyber-critical contract.
Subprocessor and concentration risk review
Subcontractor visibility and dependency concentration review, especially for cloud, infrastructure, managed service, and critical ICT providers.
Continuous monitoring cadence
Scheduled reassessments and alert-driven monitoring for breach disclosures, adverse news, regulatory actions, ownership changes, and security rating changes.
Third party incident response integration
Clear workflows for vendor-originated incidents, including ownership, impact assessment, notification decisions, and evidence capture under NIS2 timelines.
Remediation and escalation workflows
Tracked findings, responsible owners, due dates, evidence of closure, and escalation when high-severity issues remain unresolved.
Audit-ready records and metrics
A structured evidence trail showing what was assessed, when, by whom, what findings were raised, and how remediation reduced cyber risk.
