Supply Chain Risk Assessment: A Step-by-Step Guide
NIS2 requires it. DORA mandates it. Regulators audit it. StartComply automates your entire supply chain risk assessment workflow, from vendor classification to continuous monitoring and audit-ready evidence.
Trusted by 100+ organisations across Europe
NIS2 Article 21 
DORA Article 28 
Vendor Assessments 
Audit Evidence What you need to know about supply chain risk assessment
- A supply chain risk assessment covers direct vendors and downstream dependencies, including subprocessors, infrastructure providers and outsourced ICT services.
- NIS2 Article 21 requires supply chain security measures for essential and important entities, while DORA Article 28 requires ICT third-party risk management for financial entities.
- An operational process has five stages: vendor inventory, criticality tiering, questionnaire distribution, risk scoring and continuous monitoring.
- Static annual assessments do not provide enough visibility for complex supplier environments, especially when incidents, renewals or sub-outsourcing changes occur.
- Audit-ready evidence must connect vendor records, questionnaire responses, risk scores, mitigation actions and approval decisions in one traceable workflow.
- StartComply automates the assessment lifecycle so compliance teams can prove what was assessed, when it was assessed, who approved it and what changed afterwards.
Last updated May 2026.
Supply Chain Risk Assessment Requires Legal Evidence
A structured, evidenced assessment process
- NIS2 Article 21: security measures addressing supply chain relationships with direct suppliers and service providers
- DORA Article 28: ICT third-party risk policy covering the full lifecycle from assessment to exit planning
- DORA Article 30: contractual provisions for data security, audit rights, sub-outsourcing and termination
- ISO 27001:2022 Control 5.21: processes for managing information security in supplier relationships
- Timestamped records regulators can inspect, trace and verify independently
Penalty exposure: NIS2 essential entities face fines of up to €10M or 2% of global annual turnover. Sources: NIS2 Directive, DORA Regulation.
Incomplete inventories, static assessments, weak evidence
- No complete vendor inventory across procurement, finance, IT and shadow tools
- No clear vendor tiering based on data access, system dependency or operational impact
- Questionnaires chased manually by email with no consistent audit trail
- Risk scores recorded without evidence, methodology or approval history
- Annual assessments that miss incidents, sub-outsourcing changes and contract renewals
- Contract reviews disconnected from vendor risk assessment findings
The audit reality: a risk score is not evidence unless an auditor can trace it back to the questionnaire, supporting documents, scoring logic and approval decision.
Everything You Need for Supply Chain Risk Assessment
Vendor Inventory and Dependency Mapping
You cannot assess risks you have not identified. StartComply builds one structured inventory across vendors, suppliers, ICT providers, cloud services, subprocessors and operational dependencies, so your team can see the full supplier chain before risk decisions are made.
- Complete register of third-party relationships in scope
- Supplier, subprocessor and downstream dependency mapping
- Criticality fields for data access, service impact and regulatory relevance
- Imports from procurement, finance, IT asset and contract systems
Automated Risk Questionnaires and Evidence Collection
StartComply distributes structured questionnaires based on vendor tier, tracks responses, requests supporting evidence and keeps every submission connected to the assessment record. That gives compliance teams comparable, evidenceable data without chasing suppliers manually.
- Tier-based questionnaire workflows for critical, significant and standard vendors
- NIS2, DORA and ISO 27001-aligned assessment criteria
- Evidence requests for certifications, policies, reports and test results
- Overdue response tracking and supplier follow-up automation
Risk Scoring and Continuous Monitoring
Every assessment generates a risk score, residual risk view and documented decision trail. Between formal reviews, StartComply monitors changes that may affect your exposure, giving you continuous risk visibility instead of annual snapshots.
- Configurable scoring for likelihood, impact and residual risk
- Risk register entries linked to questionnaire evidence
- Triggered reassessments for incidents, renewals and material changes
- Monitoring signals for cyber, financial, regulatory and supplier status changes
Contract and Regulatory Mapping
Risk assessment findings need to feed into contracts, especially under DORA Article 30. StartComply links vendor risk data to required contractual controls so legal, procurement and compliance teams work from the same risk record.
- DORA Article 30 contractual control mapping
- Audit rights, incident notification and termination requirement tracking
- Sub-outsourcing notification fields for ICT third-party providers
- Assessment findings connected to mitigation and acceptance decisions
StartComply vs. The Alternatives
Not every supply chain risk assessment approach produces the evidence NIS2, DORA and ISO 27001 auditors expect. The difference is traceability.
StartComply was built for European teams that need to turn supplier data, questionnaires, risk scores and monitoring signals into defensible compliance evidence.
What Is a Supply Chain Risk Assessment?
A supply chain risk assessment is the systematic process of identifying, analysing and prioritising risks that enter your organisation through third-party vendors, suppliers, service providers and their downstream dependencies. It focuses on the chain of dependencies behind the services you rely on, including your vendor’s vendors, software libraries, subprocessors and infrastructure providers.
It overlaps with general vendor risk assessment, but it is not identical. Vendor risk assessment usually starts with the companies you contract with directly. Supply chain risk assessment extends that view to tier-two and tier-three dependencies, where hidden operational and cyber exposure often sits.
A complete supply chain risk assessment produces three practical outputs: a tiered supplier register mapped by criticality, a risk score for each vendor based on likelihood and impact, and documented mitigation or acceptance decisions for every material risk. Without those outputs, an organisation can claim compliance, but it cannot prove it.
The legal distinction matters. NIS2 and DORA do not stop at direct vendors. They require visibility into supplier relationships, ICT third-party dependencies and sub-outsourcing chains that could affect resilience, data security or regulated operations.
How StartComply Runs a Supply Chain Risk Assessment in Five Steps
Build your vendor inventory Scope
Start with a complete inventory of software vendors, managed service providers, cloud infrastructure providers, data processors and professional services firms with system access. StartComply consolidates supplier data from procurement, finance, IT asset and contract sources into one current assessment scope.
Tier vendors by criticality Risk tiering
Classify vendors as critical, significant or standard based on data access, integration depth, regulatory relevance and operational dependency. This ensures the assessment effort is proportionate to the risk each supplier introduces.
Send structured security questionnaires Evidence collection
Distribute questionnaires based on supplier tier and collect evidence such as certifications, security policies, business continuity documentation, subprocessor lists and incident history. StartComply tracks completion and overdue responses automatically.
Score and document risks Risk register
Translate findings into risk scores, residual risk ratings, mitigation actions and formal acceptance decisions. Each score is linked back to the questionnaire response and supporting evidence, creating a traceable decision trail.
Continuously monitor and reassess Ongoing review
Run scheduled reassessments and triggered reviews when incidents, sub-outsourcing changes, contract renewals or material vendor changes occur. Continuous monitoring keeps the register current between annual reviews.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Supply Chain Risk Assessment
What is a supply chain risk assessment and why is it required?
A supply chain risk assessment is a structured process for identifying and prioritising risks that enter an organisation through vendors, suppliers and downstream dependencies. It is required under NIS2 Article 21(2)(d) for essential and important entities and under DORA Article 28 for financial entities. Both regulations require organisations to demonstrate active risk management, not just awareness of supplier exposure.
How often should a supply chain risk assessment be repeated?
Regulators expect continuous monitoring, not point-in-time snapshots. At minimum, all vendors should be reassessed annually, while critical and significant vendors often require more frequent review. Triggered reassessments should occur after incidents, sub-outsourcing changes, contract renewals or changes in regulatory status. Annual assessments alone are insufficient for complex supplier environments.
What is the difference between supply chain risk and supplier risk?
Supplier risk focuses on direct, tier-one relationships: the vendors you contract with and pay directly. Supply chain risk extends that scope to tier-two and beyond, including vendors’ vendors, subprocessors and infrastructure dependencies. A supplier risk assessment is part of the wider supply chain risk assessment, but it is not a substitute.
What evidence do regulators expect from a supply chain risk assessment?
Regulators expect structured, timestamped records that can be traced from vendor inventory through to risk decisions. This includes a current vendor register, criticality tiers, completed questionnaires, risk scoring methodology, mitigation actions, acceptance decisions and evidence of ongoing monitoring. Audit-ready evidence must be traceable from source data to final decision.
Does DORA require supply chain risk assessment for all financial entities?
DORA applies to a broad range of financial entities, including banks, insurance companies, investment firms, payment institutions and crypto-asset service providers. Under DORA Article 28, in-scope entities must maintain an ICT third-party risk management policy covering supply chain dependencies and sub-outsourcing arrangements. The depth of assessment is proportionate, but the documentation obligation still applies.
Can spreadsheets support a compliant supply chain risk assessment programme?
Spreadsheets can capture data, but they struggle to produce audit-ready evidence at scale. They create version-control problems, do not trigger reassessments automatically and offer limited audit trails showing who assessed what and when. For organisations with meaningful supplier complexity, spreadsheets introduce the exact gaps auditors test.
Stop Running Supply Chain Risk Assessments in Spreadsheets.
Which Regulations Drive Supply Chain Risk Assessment?
NIS2, DORA and ISO 27001:2022 are the main compliance drivers forcing European organisations to formalise supply chain risk assessment. Each framework has a different scope, but they all expect documented processes, supplier visibility and evidence that risks are assessed and monitored. The overlap is operationally useful: one well-designed assessment workflow can support multiple compliance obligations.
ISO 27001:2022 Control 5.21 adds another evidence layer by requiring organisations to define and implement processes for managing information security in supplier relationships.
Supply Chain Risk Assessment Timeline: When to Assess and Reassess
Assess every critical or significant supplier before contract signature, especially where data access, ICT dependency or regulated operations are involved.
Feed assessment findings into contractual requirements, including audit rights, incident notification, sub-outsourcing controls and termination rights.
Run periodic reassessments based on supplier criticality. Critical and significant vendors should be reviewed more frequently than standard vendors.
Trigger reassessment after incidents, sub-outsourcing changes, contract renewals, ownership changes or major changes in service scope.
Maintain continuous monitoring so risk scores, supplier status and evidence records remain current between formal assessment cycles.
Assessment cadence matters. A dated PDF from eighteen months ago will not satisfy the expectation for ongoing monitoring. Regulators want to see when the assessment ran, why the risk rating changed, who approved the decision and what follow-up happened.
The Evidence Regulators Expect From a Supply Chain Risk Assessment
A compliant assessment does not end with a risk score. It must produce records a third party can inspect, trace and verify independently.
Current vendor register
A complete supplier inventory with ownership, service scope, criticality tier, data access and regulatory relevance.
Questionnaire responses
Completed supplier questionnaires mapped to the relevant control framework and stored with submission timestamps.
Supporting documents
Policies, certifications, penetration test summaries, continuity documents, subprocessor lists and other evidence files.
Risk scoring methodology
A documented approach for likelihood, impact, inherent risk, mitigating controls and residual risk classification.
Mitigation and acceptance decisions
Clear owners, dates, approvals, remediation actions and formal risk acceptance records where residual risk remains.
Monitoring activity
Evidence that vendor risk is reviewed continuously, including alerts, reassessments, contract triggers and status changes.
