Fourth-Party Risk Management: The Hidden Risk in Your Supply Chain
Your vendor passed the audit. Their vendor did not. That is the fourth party problem. StartComply maps your vendor relationships beyond the first tier, surfaces subcontractor dependencies automatically, and keeps your fourth party risk posture audit-ready.
Trusted by 100+ organisations across Europe
DORA 
NIS2 
ISO 27001:2022 
Fourth Party Risk What you need to know about fourth party risk management
- Fourth party risk management covers the subcontractors and suppliers your direct vendors rely on, creating indirect exposure you cannot ignore.
- DORA Article 28 explicitly requires financial entities to assess and manage concentration risk from ICT subcontractor chains.
- NIS2 Article 21 extends supply chain security obligations to material subcontractors of direct suppliers for essential and important entities.
- Vendor contracts must include subcontractor disclosure obligations, flow-down security requirements, and audit rights to meet regulatory expectations.
- Continuous monitoring is mandatory: a one-time fourth party assessment becomes stale within months as vendor subcontractor arrangements change.
- Automation is the only operationally viable approach to fourth party monitoring at scale. Spreadsheets cannot watch hundreds of relationships simultaneously.
Source: StartComply Editorial. Last updated May 2026.
Your vendor may be compliant. Their subcontractor may not be.
Visibility beyond your direct vendor list
- DORA Article 28: identify and assess concentration risk across ICT third-party providers and subcontractors
- DORA Article 30: contractual clauses covering subcontracting arrangements for critical functions
- NIS2 Article 21: supply chain security measures, including security practices of direct suppliers
- ISO 27001:2022 Annex A Control 5.21: ICT supply chain oversight, including sub-suppliers
- Evidence of fourth party visibility, not just third party assessments
The regulatory reality: DORA Article 28 explicitly requires concentration risk assessment, while NIS2 Article 21 requires supply chain security measures for essential and important entities.
A direct vendor register with a subcontractor blind spot
- No subcontractor disclosure obligations in older vendor contracts
- No mapping of shared cloud, DNS, identity, hosting, or data processing dependencies
- No contractual lever over fourth parties without flow-down clauses
- No alert when vendors change subcontractors after onboarding
- No evidence trail for concentration risk or subcontractor assessments
- No audit rights where subcontractor arrangements create unacceptable risk
The audit reality: a direct vendor assessment is not a fourth party risk programme. Auditors now ask what sits behind the vendor.
Everything Your Fourth-Party Risk Programme Needs
Fourth Party Discovery and Dependency Mapping
StartComply builds visibility into the suppliers, subcontractors, and service providers your direct vendors rely on.
- Subcontractor disclosure requests linked to each critical vendor
- Relationship mapping beyond the first tier
- Nth-party dependency visibility for cloud, hosting, identity, data processing, and critical components
- Gaps flagged where critical function subcontractors are undisclosed or unassessed
Targeted Fourth Party Assessments
The platform distributes targeted fourth party disclosure requests to your vendors, tracks responses, and flags incomplete or high-risk disclosures.
- Automated questionnaire distribution and follow-ups
- Risk tiering by function criticality, data sensitivity, jurisdiction, and single-point-of-failure status
- Evidence collection from vendor-owned subcontractor registers
- Assessment records mapped to DORA Article 28 and NIS2 Article 21 obligations
Continuous Monitoring and Concentration Risk Alerts
Fourth party risk is not static. StartComply auto-escalates when subcontractor arrangements change, when a fourth party appears on a threat intelligence feed, or when certification status lapses.
- Automated alerts for subcontractor changes and public breach signals
- Concentration risk mapping across shared fourth party providers
- Certification lapse and threat intelligence monitoring
- Full audit trail of disclosures, assessments, decisions, and remediation actions
StartComply vs. The Alternatives
Not all fourth party risk management approaches produce the visibility, contractual evidence, and continuous monitoring NIS2 and DORA auditors expect.
StartComply was built for European organisations that need to prove fourth party oversight across NIS2, DORA, and ISO 27001 without turning compliance into a spreadsheet archaeology project.
What Is Fourth Party Risk Management?
Third party risk management covers the vendors you contract with directly. Fourth party risk management covers the vendors your vendors rely on. Those are the organisations processing your data, hosting your vendor’s infrastructure, or delivering critical components inside services you consume, without any direct relationship with you.
Fourth parties are sometimes called Nth parties, recognising that the chain does not stop at four. A cloud provider subcontracts to a data centre operator. That operator uses a network carrier. Each link adds exposure. The further down the chain, the less visibility you have and the harder the risk is to quantify.
The distinction matters operationally. With a third party, you can issue a questionnaire, demand an audit report, or terminate the contract. With a fourth party, you have no contractual lever. Your only mechanism is pressure applied through your direct vendor, which means your vendor contracts must require subcontractor disclosure, flow-down obligations, and the right to audit.
You cannot manage what your vendor will not disclose. Fourth party risk management starts with contractual visibility into subcontractors, then turns that visibility into assessment, monitoring, concentration analysis, and audit-ready evidence.
How to Build a Fourth Party Risk Management Programme
Prioritise by criticality Critical functions
You cannot map every fourth party dependency simultaneously. Prioritise by the criticality of the function your vendor delivers. Vendors supporting critical or important functions under DORA, or essential services under NIS2, should be addressed first. Focus your initial effort on vendors where disruption would breach your obligations or SLAs.
Classify and assess fourth parties Risk tiering
Once identified, classify each fourth party by risk tier. Consider geographic location, regulatory jurisdiction, single-point-of-failure status, and the sensitivity of data or functions involved. A fourth party processing personal data on behalf of your vendor is still subject to GDPR obligations even though you have no direct contract with them.
Embed fourth party requirements Flow-down obligations
Every new or renewed vendor contract should include subcontractor disclosure obligations, approval rights for material subcontractor changes, flow-down security requirements, and the right to audit subcontractors for critical functions. Treat contract remediation as a risk reduction activity, not an administrative task.
Monitor continuously Automated alerts
Fourth party risk is not static. Vendors change their subcontractors. Acquisitions shift who processes your data. New concentration risks emerge. Continuous monitoring requires automated alerts when vendors update subcontractor registers, when a fourth party suffers a publicly disclosed breach, or when certification status changes.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Fourth Party Risk Management
What is the difference between third party and fourth party risk management?
Third party risk management covers the vendors and suppliers you have a direct contractual relationship with. Fourth party risk management covers the subcontractors and service providers that your direct vendors rely on to deliver their services to you. You have no contract with fourth parties, which means your visibility and control depend entirely on obligations you embed in your direct vendor contracts. Both layers are now subject to regulatory scrutiny under NIS2 and DORA.
Does DORA require financial entities to manage fourth party risk?
Yes. DORA Article 28 explicitly requires financial entities to identify and assess concentration risk across their ICT third-party providers and their subcontractors. Article 30 mandates contractual clauses covering subcontracting of critical or important functions. The EBA’s implementing technical standards require a register of information documenting subcontractor chains. This is a mandatory, auditable obligation, not a recommended practice.
How do I get visibility into my vendors’ subcontractors?
Visibility into fourth parties depends on what your vendor contracts require. Contracts must include subcontractor disclosure obligations, approval rights for material changes, and audit rights for critical functions. At onboarding, issue a targeted questionnaire asking vendors to disclose subcontractors involved in delivering services to you specifically. Require vendors to notify you when they add or change material subcontractors. Automated platforms like StartComply can distribute these requests and track responses systematically.
What is concentration risk in the context of fourth party suppliers?
Concentration risk arises when multiple vendors in your supply chain rely on the same fourth party provider, creating a single point of failure across your entire vendor portfolio. If five critical vendors all use the same cloud infrastructure or identity platform, a single incident at that fourth party disrupts all five simultaneously. DORA Article 28 specifically requires financial entities to assess and address this type of concentration. Mapping your fourth party layer often reveals unexpected convergence that third party assessments alone cannot identify.
Does an ISO 27001 certification cover a vendor’s subcontractors?
No. ISO 27001 certification covers the organisation’s defined scope, not the entire supply chain it relies on. A certified vendor can use uncertified, unaudited subcontractors for critical delivery components. Certification is not a proxy for fourth party visibility. You must separately assess whether your vendor’s subcontractors meet the security standards required for the functions they perform. ISO 27001:2022 Annex A Control 5.21 explicitly requires organisations to address security in the ICT supply chain, including sub-suppliers.
How often should fourth party risk assessments be updated?
Continuous monitoring is the regulatory standard, not periodic review. Vendors change subcontractors regularly. Acquisitions shift data processing arrangements. New concentration risks emerge as market consolidation occurs. Your vendor contracts should require notification of material subcontractor changes, and your monitoring processes should surface publicly disclosed incidents involving fourth parties. Annual point-in-time assessments are not sufficient to meet DORA or NIS2 expectations. Automated alerting tied to your vendor register is the only operationally viable approach at scale.
Stop Managing Fourth Party Risk with Spreadsheets.
Who Is Exposed to Fourth Party Risk?
Fourth party risk affects any organisation whose critical operations depend on vendors that rely on subcontractors, cloud providers, hosting partners, data processors, identity platforms, or other embedded service providers.
The exposure is especially important for two groups of European organisations:
Ignorance of what sits behind your third parties is not a defence. Regulators expect organisations to understand material subcontractor exposure and concentration risk.
Why Fourth Party Risk Became a Regulatory Priority
SolarWinds showed how a single supply chain compromise could affect thousands of organisations that had no direct relationship with the weak link.
NIS2 and DORA formalised stronger supply chain and ICT third-party obligations for European organisations.
The MOVEit breach cascaded through payroll processors, insurers, and government agencies via a single file transfer tool embedded in dozens of supply chains.
DORA became applicable for financial entities, making subcontractor chains and concentration risk part of the audit-ready register of information.
Fourth party visibility is now part of practical compliance. A third party assessment without subcontractor visibility leaves a material blind spot.
DORA-specific note:
Financial entities must keep fourth party data live. The register of information must be current and submitted to competent authorities on request, so last year’s assessment sitting in a shared drive is not enough.
Common Failures in Fourth Party Risk Management
Fourth party programmes usually fail in the same places: assuming certification equals visibility, treating disclosure as a one-time exercise, and documenting risk without securing contractual rights.
Assuming vendor certification covers subcontractors
ISO 27001 certification covers the organisation’s defined scope, not the entire supply chain it relies on. Certification is not a proxy for fourth party visibility.
Treating disclosure as a one-time exercise
Vendors add and change subcontractors continuously. A disclosure completed at onboarding is stale within months if there is no mechanism to receive and act on subcontractor change notifications.
Documenting risk without audit rights
A fourth party register with no contractual audit rights proves you mapped the risk. It does not give you power to address it when subcontractor arrangements create unacceptable exposure.
Ignoring concentration risk
If multiple critical vendors rely on the same cloud hyperscaler, DNS provider, identity platform, or file transfer tool, one incident at that fourth party can disrupt your entire vendor portfolio.
Failing to remediate old contracts
Most vendor contracts written before 2022 contain no subcontractor disclosure requirements. Closing this gap requires a deliberate contract remediation programme across your vendor estate.
