Vendor Risk Management: The Complete EU Guide
Vendor risk management is now a legal, operational, and board-level priority for EU organisations. StartComply automates vendor onboarding, tiered assessments, continuous monitoring, remediation workflows, and audit-ready evidence for NIS2, DORA, ISO 27001:2022, and GDPR-aligned supplier oversight.
Trusted by 100+ organisations across Europe
NIS2 
DORA 
ISO 27001:2022 
GDPR Article 28 What you need to know about vendor risk management
- Vendor risk management is the operational programme for identifying, assessing, mitigating, and continuously monitoring risk across commercial supplier and service-provider relationships.
- NIS2 Article 21 makes supply chain security a mandatory cybersecurity measure for essential and important entities across the EU.
- DORA Article 28 and Article 30 require financial entities to maintain ICT third-party risk controls, registers, monitoring, exit strategies, and mandatory contract clauses.
- Annual questionnaires are not enough. Regulators expect a current vendor register, risk-tiered assessments, continuous monitoring, and dated evidence.
- StartComply centralises vendor onboarding, classification, questionnaires, remediation, fourth-party visibility, and audit evidence in one EU-focused platform.
Sources: NIS2 Directive, DORA Regulation. Last updated May 2026.
What Is Vendor Risk Management?
Vendor risk management is the structured discipline of understanding and controlling the risk your organisation accepts every time it engages a commercial vendor, supplier, SaaS provider, ICT service provider, processor, or outsourced operational partner. It covers cybersecurity risk, operational resilience, data protection, concentration risk, compliance risk, and contractual control gaps.
A mature vendor risk management programme starts before onboarding and continues until the relationship is formally terminated. It classifies vendors by criticality, collects evidence, scores risk, tracks remediation, monitors changes, and proves that risk decisions were taken by the right owners. Every vendor with system access, personal data, or operational dependency belongs in scope.
Vendor risk management is narrower than third-party risk management and more operational than supply chain risk management. TPRM covers all external parties, including contractors, consultants, agents, and partners. SCRM looks across the wider supplier ecosystem. VRM focuses specifically on commercial vendor and supplier relationships.
One vendor register is not enough. EU regulators expect dated assessments, documented risk decisions, contract controls, monitoring activity, and evidence that findings were remediated or formally accepted.
Vendor Risk Is a Compliance Obligation Requiring Evidence
A documented, evidenced, continuous vendor programme
- NIS2 Article 21: supply chain security measures for direct suppliers and service providers
- DORA Article 28: ICT third-party risk policy, register, monitoring, and exit strategy
- DORA Article 30: mandatory contract provisions, audit rights, incident support, and sub-outsourcing controls
- GDPR Article 28: processor contracts, sub-processor conditions, and data return or deletion duties
- ISO 27001:2022 Annex A 5.19 to 5.22: information security in supplier relationships
Penalty exposure: NIS2 essential entities face up to €10 million or 2% of global annual turnover. Sources: NIS2 Directive, DORA Regulation.
Email, spreadsheets, shared drives, and annual questionnaires
- Vendor inventory split across procurement, finance, IT, and security teams
- Questionnaire responses stored as static files with no version control
- Critical vendors assessed with the same depth as low-risk suppliers
- Findings tracked informally with no owner, due date, or escalation path
- Contractual controls reviewed too late, often after procurement has already committed
- No visibility into sub-processors, sub-outsourcing, or fourth-party concentration risk
The audit reality: regulators ask for evidence. They expect vendor registers, dated assessments, risk decisions, contracts, monitoring records, and remediation history.
Who Needs Vendor Risk Management Under EU Rules?
Vendor risk obligations apply wherever suppliers support regulated operations, process personal data, provide ICT services, or affect continuity of essential services. For most EU teams, the question is no longer whether vendors are in scope. The question is how quickly the organisation can evidence control.
Management accountability is real. Vendor risk decisions should be approved, documented, and traceable to the correct business owner.
Vendor Risk Management Timeline for EU Compliance
NIS2 transposition deadline. Supply chain security became a mandatory cybersecurity measure under national implementation across member states.
DORA became applicable, including Article 28 ICT third-party risk management and Article 30 contractual requirements for financial entities.
Competent authorities, supervisory bodies, and certification auditors increasingly request vendor registers, dated assessments, contract controls, and monitoring records.
Material vendor changes, breaches, sub-outsourcing changes, and critical findings should trigger reassessment, escalation, and evidence updates.
Country implementation varies. Use the strictest applicable national NIS2 rules when vendor services support entities across multiple EU member states.
The 10 Components of a Complete Vendor Risk Management Programme
A working vendor risk management programme is not a policy document. It is a repeatable operating model with clear owners, a defined cadence, and the evidence trail regulators expect.
Vendor inventory
A complete register of suppliers, ICT providers, processors, SaaS tools, outsourced service providers, and business-critical vendors in scope.
Risk classification
A tiering model based on criticality, data access, ICT dependency, service type, business impact, and regulatory relevance.
Due diligence workflow
Questionnaires, evidence requests, ownership, reminders, scoring, and approvals aligned to each vendor tier.
Contract control mapping
A method for checking incident support, audit rights, sub-outsourcing, exit, portability, data protection, and service-level clauses.
Risk register
A central record of findings, ratings, owners, remediation actions, due dates, exceptions, and accepted residual risks.
Continuous monitoring
Signals that detect breaches, financial distress, service changes, concentration risk, and control degradation between formal assessments.
Fourth-party visibility
Disclosure and tracking of important sub-processors, sub-outsourcing chains, and shared critical dependencies across the vendor portfolio.
Offboarding controls
Documented access revocation, data return or deletion, evidence retention, and clean termination of vendor dependencies.
Board and management reporting
Metrics that show exposure, overdue actions, critical vendor concentration, remediation progress, and regulatory readiness.
Audit evidence trail
Version-controlled records that prove assessments, decisions, approvals, monitoring, and remediation happened when claimed.
How StartComply Runs Vendor Risk Management in Five Steps
Build your VRM operating model NIS2 Art. 21
Define ownership, vendor tiers, escalation paths, and risk acceptance rules in a repeatable vendor risk management framework. StartComply turns that model into configurable workflows, approvals, and evidence rules.
Map each vendor to the right risk tier DORA Art. 28
Import vendors, classify criticality, map service scope, and connect each relationship to the five lifecycle phases. Critical vendors get deeper assessments and more frequent monitoring.
Collect evidence and score risk ISO 27001:2022
Send risk-tiered assessments, collect evidence, score responses, and flag gaps using tiered questionnaire design. Every response is dated, versioned, and attached to the vendor record.
Assign actions and track closure GDPR Art. 28
Convert gaps into remediation tasks with owners, due dates, severity, and escalation. StartComply supports VRM programme governance by showing which risks are open, accepted, overdue, or closed.
Monitor continuously and prepare for audit Audit ready
Keep assessments, contract reviews, monitoring events, approvals, and remediation records in one evidence trail. When auditors ask, export audit-ready evidence without rebuilding the story manually.
Everything Your Vendor Risk Management Programme Needs
Vendor Registry and Classification
StartComply gives you one authoritative record for every vendor relationship in scope. Classify vendors by criticality, access scope, data category, service type, country exposure, and regulatory relevance.
- Central vendor inventory with configurable fields
- Critical, high, standard, and low-risk tiering
- DORA ICT register-ready data structure
- Ownership mapping across procurement, legal, IT, and compliance
Risk-Tiered Assessment Workflows
Stop sending the same questionnaire to every supplier. StartComply distributes assessment workflows based on vendor tier, service scope, and data access.
- Automated questionnaire distribution and reminders
- NIS2, DORA, GDPR, and ISO 27001:2022 control mapping
- Evidence uploads linked to each vendor record
- Version-controlled assessment history
Continuous Monitoring and Alerts
Vendor risk changes between annual reviews. StartComply monitors vendor status, control gaps, critical changes, open findings, and reassessment triggers continuously.
- Risk score updates between assessment cycles
- Alerts for overdue actions and stale evidence
- Material change triggers for reassessment
- Escalation workflows for high-severity findings
Contract and Compliance Controls
Map vendor contracts to the clauses regulators expect, including audit rights, data protection duties, incident support, exit assistance, and sub-outsourcing controls.
- DORA Article 30 clause tracking
- GDPR Article 28 processor agreement checks
- Incident notification and assistance requirements
- Exit, portability, and data deletion obligations
Fourth-Party and Concentration Visibility
Track important sub-processors, sub-outsourcing chains, and shared dependencies so vendor risk management does not stop at Tier 1.
- Sub-processor and subcontractor disclosure fields
- Critical dependency mapping across vendors
- Concentration risk visibility by provider and service type
- Escalation when critical vendors rely on the same underlying provider
Audit-Ready Evidence by Default
Every action in StartComply produces evidence automatically: assessments, approvals, risk acceptance, contract checks, remediation updates, and monitoring activity.
- Dated records for each vendor assessment
- Evidence attachments tied to control requirements
- Risk decisions and approvals captured in one place
- Exportable audit packs for regulators and certification auditors
StartComply vs. Manual Vendor Risk Management
Vendor risk management only works when the process produces evidence as the work happens. Static spreadsheets and annual questionnaires do not create a reliable control environment.
StartComply is built for European organisations that need NIS2, DORA, GDPR, and ISO 27001:2022 evidence without enterprise GRC overhead.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Vendor Risk Management
What is vendor risk management and why does it matter for EU compliance?
Vendor risk management is the process of identifying, assessing, mitigating, and continuously monitoring the risks that suppliers and service providers introduce to your organisation. It matters because NIS2 Article 21 requires supply chain security controls and DORA Article 28 requires financial entities to manage ICT third-party risk across the contract lifecycle.
How often should vendors be reassessed under NIS2 and DORA?
NIS2 and DORA both point towards ongoing monitoring rather than a single annual snapshot. A practical model combines continuous monitoring with risk-based reassessment triggers, including vendor breaches, material service changes, mergers, new sub-outsourcing, control failures, and expired evidence. Annual reviews alone are not enough for critical vendors.
What is the difference between vendor risk management and third-party risk management?
Third-party risk management is the broader discipline covering vendors, contractors, consultants, partners, agents, and other external parties. Vendor risk management is the vendor-specific subset focused on commercial suppliers and service providers. For many organisations, VRM is the most operational part of the broader third-party control environment.
How do I handle fourth-party risk in a vendor risk programme?
Fourth-party risk refers to the risk introduced by your vendors’ own vendors, sub-processors, or subcontractors. A strong programme requires disclosure of key dependencies, sub-outsourcing controls, concentration analysis, and periodic review of critical chains. Start with fourth-party risk visibility for critical ICT and data-processing vendors.
What evidence do regulators expect during a vendor risk audit?
Auditors typically ask for a current vendor register, risk classifications, dated assessments, questionnaire responses, evidence attachments, risk scores, remediation records, contract controls, monitoring activity, and approval history. The key point is proof: documented evidence should show what happened, when it happened, who approved it, and how findings were closed.
What are the most important vendor risk best practices?
The strongest programmes use risk-tiered assessments, centralised registers, continuous monitoring, contract control checks, remediation workflows, fourth-party visibility, and board-level reporting. These vendor risk best practices reduce audit pressure because evidence is generated throughout normal work, not assembled at the last minute.
