Supplier Risk Assessment: How to Evaluate Your Suppliers
Supplier risk assessment is no longer a spreadsheet exercise. NIS2 requires it. DORA mandates it. Regulators audit it. StartComply automates supplier due diligence, risk scoring, continuous monitoring, and audit-ready evidence from one platform.
Trusted by 100+ organisations across Europe
NIS2 DORA 
ISO 27001:2022 
Supplier Risk What you need to know about supplier risk assessment
- Supplier risk assessment is required under NIS2 Article 21, DORA Articles 28-30, and ISO 27001:2022 controls A.5.19 and A.5.21.
- Start with supplier classification. Criticality, data access, system access, and regulatory scope determine assessment depth.
- Evidence beats self-attestation. Certificates, audit reports, penetration test summaries, and control documentation matter.
- DORA Article 30 requires contractual controls such as audit rights, incident notification obligations, data security, and sub-outsourcing restrictions.
- Continuous monitoring of Tier 1 suppliers is mandatory in practice. Annual questionnaires alone do not reflect current supplier risk.
- StartComply automates supplier questionnaires, evidence collection, risk scoring, monitoring, and audit-ready reporting.
Sources: NIS2 Directive, DORA Regulation. Last updated January 2025.
Supplier Risk Assessment Requires Audit-Ready Evidence
A structured, evidenced supplier risk programme
- NIS2 Article 21: supply chain security and supplier relationships as mandatory cybersecurity measures
- DORA Article 28: ICT third-party risk management integrated into the risk framework
- DORA Article 29: pre-contractual due diligence before supplier engagement
- DORA Article 30: audit rights, incident obligations, and sub-outsourcing controls
- ISO 27001:2022 controls A.5.19 and A.5.21 for supplier and ICT supply chain security
Penalty exposure: NIS2 fines can reach €10M or 2% of global annual turnover for essential entities. Sources: NIS2 Directive, DORA Regulation.
Spreadsheets, email chains, and self-attestation
- Supplier data scattered across procurement, finance, and IT systems
- Questionnaires accepted without certificates, reports, or control evidence
- No consistent risk scoring across cybersecurity, operational, financial, and compliance domains
- Missing DORA Article 30 contractual controls for ICT third-party providers
- Annual reviews that miss certification lapses, breaches, ownership changes, and financial distress
- No timestamped audit trail showing who approved residual risk and why
The audit reality: regulators do not just ask whether supplier assessments exist. They ask for evidence, dates, owners, decisions, and follow-ups.
Everything Your Supplier Risk Assessment Workflow Needs
Supplier Register and Risk Classification
Build one authoritative register of every supplier relationship in scope. Classify each supplier by criticality, data access, system access, service dependency, and regulatory scope.
- Centralised supplier inventory across procurement, finance, and IT
- Tier 1, Tier 2, and Tier 3 classification logic
- DORA ICT third-party register fields supported
- Risk-based assessment depth for each supplier tier
Evidence-Based Supplier Due Diligence
Stop relying on supplier self-attestation. StartComply collects questionnaires, certificates, audit reports, and control evidence, then scores each supplier using a consistent, documented methodology.
- Automated questionnaire distribution and reminders
- Evidence requests for ISO 27001, SOC 2, penetration testing, and control documentation
- Comparable scoring across cybersecurity, operational, financial, and compliance domains
- Residual risk approval records with owners and review dates
Continuous Monitoring and Audit Trail
A supplier that was low-risk last year may not be low-risk today. StartComply monitors material changes and keeps every supplier record time-stamped, version-controlled, and ready for audit.
- Alerts for financial distress, security incidents, certification lapses, and ownership changes
- Continuous monitoring for Tier 1 suppliers
- DORA Article 30 contractual control tracking
- Exportable supplier risk register for auditors and regulators
StartComply vs. Supplier Risk Assessment Alternatives
Supplier risk assessment only works if the process is consistent, evidenced, monitored, and exportable when auditors ask for proof.
StartComply was built for European teams that need supplier risk assessment evidence for NIS2, DORA, and ISO 27001:2022.
What Is a Supplier Risk Assessment?
A supplier risk assessment is a structured evaluation of the risks a specific supplier introduces to your organisation. It covers cybersecurity posture, financial stability, operational resilience, data handling practices, subcontractor exposure, and regulatory compliance. The output is a risk profile: a documented and evidenced view of how much risk that supplier creates and what controls are in place to manage it.
The key word is evidenced. A supplier saying they are ISO 27001 certified is not enough. A valid certificate, audit scope, control mapping, and review record are the kind of independently verified evidence auditors expect to see.
Supplier risk assessments are closely related to vendor risk assessments, but suppliers often sit deeper in the operational or technical delivery chain. They may process your data, host your infrastructure, or provide services your own regulated activities depend on. That dependency creates compounding risk: if a critical supplier fails, you may fail too.
Self-attestation is not enough. Questionnaires are useful, but supplier claims must be validated with certificates, audit reports, control evidence, and documented risk decisions.
How to Run a Supplier Risk Assessment in Five Steps
Build your supplier register DORA Art. 28
Pull suppliers from procurement, finance, and IT. Classify each one by data access, system access, service criticality, and regulatory scope. This determines which suppliers need full assessment and which can follow a lighter risk-based process.
Send structured due diligence questionnaires NIS2 Art. 21
For Tier 1 and Tier 2 suppliers, send a structured vendor risk assessment questionnaire covering cybersecurity controls, data handling, subcontractor use, incident history, and business continuity. Set deadlines and treat non-response as a risk signal.
Review evidence and score risk ISO 27001
Validate supplier claims with certificates, audit reports, penetration test summaries, and control documentation. Score risk consistently across the supplier portfolio so ratings are comparable and decisions can be defended.
Embed contractual controls DORA Art. 30
Review supplier contracts for audit rights, incident notification obligations, data security requirements, and sub-outsourcing controls. Where gaps exist, remediate them or formally accept the residual risk with approval and review dates.
Monitor suppliers continuously Ongoing control
Track material changes such as financial distress, public security incidents, certification lapses, ownership changes, and subcontractor updates. Tier 1 suppliers should be monitored continuously, not only during annual review cycles.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Supplier Risk Assessment
What is a supplier risk assessment and why is it required?
A supplier risk assessment is a structured evaluation of the cybersecurity, operational, financial, and compliance risks that a specific supplier introduces to your organisation. It is required under NIS2 Article 21(2)(d), DORA Articles 28-30, and ISO 27001:2022 controls A.5.19 and A.5.21. Failure to maintain documented supplier assessments can create significant regulatory exposure, including NIS2 fines of up to €10 million or 2% of global annual turnover for essential entities.
How often should supplier risk assessments be reviewed?
Tier 1 suppliers should be monitored continuously and formally reassessed at least annually or whenever a material change occurs, such as a security incident, change in ownership, or certification lapse. Tier 2 and Tier 3 suppliers can be reviewed on a risk-proportionate schedule, typically every 12 to 24 months. The key is that risk classifications reflect current supplier conditions, not last year’s questionnaire.
What is the difference between a supplier risk assessment and a vendor risk assessment?
In most compliance programmes, the terms are used interchangeably. Vendor risk assessment usually covers all third-party relationships, while supplier risk assessment focuses on entities that contribute to your operational or technical delivery chain. The practical difference is dependency: suppliers often have deeper operational integration, which increases the potential impact of their failure or compromise.
What domains should a supplier risk assessment cover?
A thorough supplier assessment should cover cybersecurity controls and certifications, data handling and GDPR compliance, subcontractor and fourth-party risk, business continuity and disaster recovery, financial stability, incident history, and contractual compliance with DORA Article 30. The domains you prioritise should reflect supplier tier and service criticality.
Can I use a questionnaire as the sole basis for a supplier risk assessment?
No. A questionnaire is a starting point for gathering supplier self-attestation, not a complete assessment. Regulators and auditors expect validated evidence such as current ISO 27001 certificates, penetration test summaries, audit reports, and control documentation. Self-attestation without evidence will not satisfy NIS2 or DORA audit requirements.
How does DORA change supplier risk assessment requirements for financial firms?
DORA requires financial entities to maintain a complete register of ICT third-party providers, perform pre-contractual due diligence under Article 29, and include specific contractual clauses under Article 30. These clauses cover audit rights, incident notification timelines, data security, and sub-outsourcing controls. DORA makes supplier assessment a formal ICT risk obligation, not a procurement formality.
Stop Managing Supplier Risk with Spreadsheets.
Who Needs Supplier Risk Assessment Under NIS2 and DORA?
Supplier risk assessment matters most for organisations whose suppliers can disrupt regulated services, access sensitive data, process personal information, or operate ICT systems that support critical business functions.
Under NIS2 and DORA, supplier risk cannot be pushed into procurement alone. It must be governed, evidenced, and reviewed as part of the organisation’s broader risk and cybersecurity programme.
Supplier dependency creates regulatory exposure. If a supplier processes your data, hosts your infrastructure, supports regulated services, or sits in your critical delivery chain, its risk profile needs to be assessed and evidenced.
Supplier Risk Assessment Timeline: What Happens When
Classify the supplier by service criticality, data access, system access, and regulatory scope before you send any due diligence request.
Run due diligence, validate evidence, score inherent risk, and review DORA Article 30 contractual controls before signing.
Monitor Tier 1 suppliers for financial distress, security incidents, certification lapses, ownership changes, and subcontractor changes.
Reassess supplier risk at least annually for critical suppliers, and sooner when material changes occur.
Export the supplier register, assessment history, evidence, approvals, remediation actions, and monitoring records without rebuilding the story manually.
Audit-ready means live evidence.
A supplier risk programme should not be rebuilt the week before an audit. StartComply keeps supplier records, evidence, timestamps, approvals, and follow-ups maintained continuously.
The Core Domains of a Supplier Risk Assessment Template
A practical template gives every assessment the same structure, scoring logic, and evidence standard. These are the domains auditors expect to see covered.
Supplier identification
Legal name, service description, business owner, contract owner, location, and relationship status.
Criticality classification
How the supplier affects operations, regulated services, customer delivery, and business continuity.
Data and system access
Whether the supplier processes personal data, sensitive data, production systems, or privileged access.
Cybersecurity controls
Security certifications, control frameworks, vulnerability management, incident history, and technical safeguards.
Operational resilience
Business continuity, disaster recovery, service availability, recovery objectives, and dependency mapping.
Financial stability
Financial distress signals, credit indicators, ownership changes, and long-term viability.
Contractual controls
Audit rights, incident notification obligations, data protection clauses, and sub-outsourcing restrictions.
Residual risk and remediation
Final risk rating, accepted risks, required actions, owners, due dates, and review cadence.
