What Is Third-Party Risk Management (TPRM)?
Third party risk management is the systematic way to identify, assess, mitigate, and continuously monitor risks from vendors, suppliers, service providers, and partners. NIS2 Article 21 and DORA Article 28 make it mandatory. StartComply automates the entire TPRM lifecycle so you can prove audit-ready compliance, not chase evidence across inboxes.
Trusted by 100+ organisations across Europe
NIS2 
DORA 
ISO 27001:2022 
TPRM What you need to know about third party risk management
- Third party risk management is the continuous process of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, service providers, and partners across their
- NIS2 Article 21 and DORA Articles 28 and 30 make TPRM a mandatory legal obligation for covered entities in Europe, with fines that can reach €10 million or 2% of global annual turnove
- A mature TPRM programme covers five stages: vendor inventory and tiering, due diligence, contractual controls, continuous monitoring, and incident response plus exit planning.
- Annual questionnaires are not continuous monitoring. Regulators expect current risk visibility, escalation, and documented audit trails.
- TPRM controls can and should be mapped once and reused across NIS2, DORA, ISO 27001:2022, and GDPR compliance evidence.
- StartComply replaces manual spreadsheet-based programmes with automated assessment workflows, continuous vendor monitoring, and evidence generation.
- Exit planning for critical third parties is an explicit DORA Article 28 requirement, not an optional contingency exercise.
Sources: NIS2 Directive, DORA Regulation. Last updated May 2026.
Third-Party Risk Is a Legal Obligation, Not Admin Work
A documented, evidenced, continuous TPRM programme
- NIS2 Article 21: supplier and service provider security as a mandatory cybersecurity measure
- DORA Article 28: ICT third-party provider register, pre-contract risk assessment, monitoring, and exit planning
- DORA Article 30: contractual provisions for service levels, audit rights, incident notification, and termination
- ISO 27001:2022 Control 5.21: structured management of information security in supplier relationships
- Documented evidence available on demand for regulators, auditors, and management bodies
Penalty exposure: NIS2 essential entities face fines up to €10M or 2% of global annual turnover. DORA adds supervisory enforcement, contractual scrutiny, and management accountability for ICT third-party risk.
Spreadsheets, email threads, annual questionnaires
- Incomplete vendor inventory, especially when shadow IT tools are purchased outside procurement
- No consistent risk tiering for critical, high-risk, standard, and low-risk third parties
- No audit trail showing when assessments ran, who reviewed them, and what decisions were made
- Missing audit rights, incident notification duties, and exit clauses in supplier contracts
- Annual questionnaires that miss breaches, subprocessor changes, and certification lapses between cycles
- No escalation path when high-risk findings or missing evidence remain unresolved
The audit reality: regulators do not ask whether you have a TPRM policy. They ask for vendor lists, dates, owners, decisions, monitoring evidence, and follow-up actions.
Everything Your Third-Party Risk Programme Needs
Vendor Inventory and Risk Classification
StartComply gives you one authoritative record of every third party relationship in scope. Capture who they are, what they provide, what systems they connect to, and what data they access.
- Complete vendor inventory across suppliers, SaaS tools, ICT providers, processors, and outsourced functions
- Configurable fields for service category, access scope, data type, geography, and business owner
- Risk tiering for critical, high-risk, standard, and low-risk third parties
- Automated import from procurement, ERP, and internal systems
Due Diligence and Initial Assessment
Before contracting, StartComply helps you assess each third party proportionately to its risk tier, with the right level of security, compliance, financial, and operational review.
- Automated questionnaires and follow-up workflows
- Risk-tiered assessment depth for critical and lower-risk vendors
- Evidence requests for ISO 27001, SOC 2, penetration tests, policies, and certifications
- Structured scoring that turns responses into risk decisions
Contractual Controls and Obligations
Contracts become part of your control framework, not just commercial paperwork. StartComply tracks whether the required provisions are present before risk is accepted.
- DORA Article 30-aligned contractual checks
- Audit rights clauses, incident notification duties, security requirements, and service levels
- Exit and termination provisions for critical ICT providers
- Contract evidence stored against the vendor record for future audits
Continuous Monitoring and Risk Alerts
Annual reassessments are not continuous monitoring. StartComply keeps vendor risk visible between formal review cycles, so changes are not discovered months too late.
- Security ratings, breach signals, sanctions, news, and financial distress monitoring
- Automated risk alerts when indicators change
- Risk score updates between assessment cycles
- Escalation workflows for overdue evidence and unresolved findings
Incident Response and Exit Planning
When a third party suffers an incident or becomes unviable, your response cannot start from scratch. StartComply links incident workflows, notification obligations, corrective actions, and exit strategies to each critical provider.
- NIS2 24-hour early warning and 72-hour notification support
- DORA-aligned exit planning for critical ICT third parties
- Documented transition evidence for alternative providers and continuity actions
- Owner, deadline, and status tracking for remediation tasks
StartComply vs. The Alternatives
Not all third party risk management approaches produce the evidence NIS2, DORA, ISO 27001, and auditors expect.
StartComply was built for European compliance teams that need evidence-ready TPRM without turning every vendor review into a consultancy project.
What Is Third Party Risk Management?
Third party risk management (TPRM) is the systematic process of identifying, assessing, mitigating, and continuously monitoring risks that arise from relationships with vendors, suppliers, service providers, outsourced functions, and partners. If a third party handles your data, connects to your systems, or delivers a service your organisation depends on, their failures can become your failures.
TPRM is not a single questionnaire or a one-off onboarding check. It is a continuous programme that spans pre-contract due diligence, onboarding assessments, in-contract monitoring, and offboarding controls. The goal is to know who your third parties are, understand what risks they introduce, and prove to regulators that those risks are controlled with documented evidence. For cross-framework control mapping, see our third party compliance risk management guide.
Third parties introduce risk across several dimensions: operational risk when a supplier failure disrupts services, cyber risk when a vendor becomes an attack vector, compliance risk when a third party violates obligations you are bound by, and concentration risk when too many critical services depend on a single provider.
TPRM is evidence, not paperwork. A mature programme shows which vendors are in scope, how they were assessed, what controls were required, what changed over time, and what decisions were made by accountable owners.
How StartComply Manages Third Party Risk in Five Steps
Catalogue every third party DORA Art. 28
Build a complete inventory of vendors, suppliers, SaaS tools, ICT providers, processors, partners, and outsourced services. Capture service type, owner, access scope, data handled, geography, and contract status so your programme starts from one reliable source of truth.
Tier vendors by risk NIS2 Art. 21
Classify vendors by criticality, data sensitivity, system access, operational dependency, and concentration exposure. Tiering determines due diligence depth, review frequency, contract controls, and monitoring intensity.
Run due diligence before and during the relationship Risk-based review
Assess each third party’s security posture, compliance status, financial stability, and operational resilience. Collect evidence such as ISO 27001, SOC 2, policies, penetration tests, certifications, and completed questionnaires.
Embed obligations into contracts DORA Art. 30
Track whether contracts include service levels, security requirements, audit rights, incident notification duties, subprocessor visibility, termination rights, and exit clauses. Missing contractual controls should be visible before risk is accepted.
Keep risk visible between review cycles Continuous evidence
Monitor third parties for breaches, sanctions, financial distress, certification changes, subcontractor changes, and risk score movement. Link alerts to owners, corrective actions, and evidence so annual reviews are not your only line of defence.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Third Party Risk Management
What is third party risk management and why does it matter for EU companies?
Third party risk management is the process of identifying and controlling risks that come from vendors, suppliers, service providers, outsourced functions, and partners. It matters for EU companies because NIS2 Article 21 and DORA Articles 28 and 30 make it a mandatory compliance requirement, not a voluntary best practice. Regulators expect audit-ready evidence of continuous monitoring, not just completed questionnaires.
What is the difference between third party risk management and vendor management?
Vendor management focuses on commercial relationships: contracts, service levels, pricing, and performance. Third party risk management focuses on the risks those vendors introduce, including cybersecurity exposure, operational dependency, compliance obligations, and concentration risk. A mature programme integrates both so commercial and risk teams work from the same vendor inventory.
How often should third party risk assessments be conducted?
Risk assessments should be proportionate to vendor tier. Critical vendors usually require at least annual reassessment, with continuous monitoring in between. Lower-risk vendors may be reassessed every two to three years. The key distinction is that reassessment is not monitoring; point-in-time reviews miss new subprocessors, breaches, certification lapses, and financial instability between cycles.
What is the difference between TPRM and supply chain risk management?
Supply chain risk management covers risks across the wider end-to-end supply chain, including logistics, geopolitical exposure, raw materials, and multi-tier dependencies. Third party risk management is usually focused on organisations you contract with directly, such as IT vendors, managed service providers, data processors, and outsourced functions. Under NIS2, supplier security aligns closely with TPRM in practice.
What should a third party risk management framework include?
A functional framework includes a complete vendor inventory with risk tiering, proportionate due diligence for each tier, contractual controls that meet NIS2 and DORA requirements, continuous monitoring of vendor risk indicators, and documented exit strategies for critical providers. Each stage should produce audit-ready evidence.
Can spreadsheets handle third party risk management effectively?
No. Spreadsheets fail at the scale most organisations operate at and cannot provide continuous monitoring, automated escalation, version-controlled decisions, or evidence logs. They rely on individuals remembering to update them, which does not happen consistently. Automated platforms generate the evidence trail that auditors and regulators expect without the manual overhead.
Stop Managing Third Party Risk with Spreadsheets.
Who Needs Third Party Risk Management Under NIS2 and DORA?
TPRM applies wherever an organisation depends on vendors, ICT providers, processors, suppliers, or outsourced functions that can affect cybersecurity, operational resilience, data protection, or regulated service delivery. Under European law, the obligation is clearest for NIS2 essential and important entities and for financial entities subject to DORA.
If a third party handles sensitive data, connects to your systems, delivers a critical service, or supports a regulated activity, it should be inside your risk management scope.
Personal accountability is real. TPRM is no longer just a procurement or IT task; it is a board-level evidence requirement under European cybersecurity and operational resilience rules.
Third-Party Risk Compliance Timeline: Current Status
NIS2 transposition deadline. Covered organisations were expected to implement cybersecurity measures that include supply chain and supplier security controls.
DORA became applicable for financial entities, including ICT third-party risk management, provider registers, contractual controls, monitoring, and exit planning.
Member states’ deadline to identify essential and important entities under NIS2. Organisations should already understand whether they fall within scope.
National competent authorities continue building and executing enforcement programmes. Vendor risk evidence, monitoring records, and management ownership are becoming audit focus areas.
Third party risk enforcement is live. Annual questionnaires, undocumented decisions, and scattered vendor files create active compliance risk.
Operating in Germany?
Germany’s NIS2 implementation law (NIS2UmsuCG) requires affected organisations to register with the BSI. Supplier security, vendor evidence, and ICT dependency visibility should be prepared before supervisory questions arrive.
The 10 Components of a Complete TPRM Programme
A working third party risk management programme is more than a policy. It contains clear scope, vendor ownership, risk-based controls, continuous monitoring, and the evidence trail regulators expect. To benchmark your current state, use the vendor risk management maturity model.
Defined scope
Which third parties, legal entities, data types, systems, geographies, and outsourced services are inside the TPRM programme.
Vendor inventory
A complete, searchable list of vendors, suppliers, ICT providers, processors, SaaS tools, and outsourced functions.
Risk classification
A tiering model that defines critical, high, standard, and low-risk third parties based on access, dependency, and impact.
Due diligence process
A proportionate assessment process that collects security, compliance, financial, and resilience evidence before contracting and during review cycles.
Contract control library
Required clauses for audit rights, incident notification, service levels, security measures, subcontracting, termination, and exit support.
Continuous monitoring
Signals that track vendor risk between formal assessments, including breaches, sanctions, financial distress, and certification changes.
Corrective action workflow
Clear owners, deadlines, escalation paths, and evidence for remediating high-risk findings and missing controls.
Incident response integration
Defined steps for handling third party incidents, including NIS2 notification timing and internal decision records.
Exit planning
Documented transition options for critical providers so service continuity does not depend on a failing vendor.
Audit evidence trail
A structured record of assessments, approvals, reviews, monitoring alerts, decisions, and follow-ups that can be produced on demand.
