Third-party risk management for NIS2 and DORA
Supply-chain obligations are now law — NIS2 Article 21 and DORA Articles 28–44. Inventory, assess and continuously monitor your ICT suppliers on Panorays.
Third-party risk management is the identification, assessment and monitoring of cybersecurity risk in your suppliers. NIS2 Article 21 and DORA Articles 28–44 make it a legal obligation — not a best practice. Passeca inventories your ICT vendors, maps the regulatory obligations, assesses each supplier on the Panorays platform, embeds the required contractual clauses, and monitors continuously.
Supply-chain risk is now a legal obligation
Two EU regimes introduce specific supply-chain risk management requirements for organisations within their scope.
Supply-chain security for essential and important entities
NIS2 requires entities to implement cybersecurity risk-management measures that cover their supply chain and suppliers — including the risk at each direct supplier and the security-related practices of the entities themselves. Failure is a compliance breach with fines up to €10m or 2% of global turnover.
ICT third-party risk for financial entities
DORA requires financial entities to maintain a register of information on all ICT arrangements, conduct due diligence, embed contractual clauses, define exit strategies, and monitor critical ICT providers continuously. Critical providers are also brought under direct ESA oversight.
For most other frameworks — ISO 27001, SOC 2, HIPAA — supplier risk is a control requirement too. Passeca builds a single programme that satisfies all of them, with Panorays as the monitoring engine.
What is third-party risk management?
Third-party risk management (TPRM) is the discipline of identifying, assessing, treating and monitoring the cybersecurity risk that suppliers and service providers introduce into your organisation. It covers every ICT supplier with access to your data, systems or network — from cloud platforms and SaaS tools to managed-service providers and offshore development partners.
It matters because the boundary of your organisation is no longer the boundary of your risk. A supplier's breach becomes your breach, a supplier's exposure becomes your exposure, and a supplier's outage becomes your outage. NIS2 and DORA now make managing that risk mandatory; ISO 27001, SOC 2, HIPAA and PCI DSS all require it as a control. Passeca delivers TPRM as a continuous programme on the Panorays platform.
What does third-party risk actually require?
A defensible TPRM programme covers the full supplier lifecycle, from onboarding to offboarding, and keeps the risk picture current rather than annual.
- Inventory and criticality — a complete register of ICT suppliers, scored by criticality and the data or systems they can reach.
- Due diligence — assess each critical vendor's security posture before and during the relationship.
- Contractual clauses — security, breach-notification, audit and exit requirements written into the contract (DORA, data-protection terms).
- Continuous monitoring — a live risk score per supplier that updates as external posture and breach history change.
- Concentration risk — awareness of dependency on a small number of providers, especially critical ICT providers.
- Exit and remediation — a plan for when a vendor fails its assessment or a relationship must end.
- Register of information — the DORA-mandated structured record, produced to authorities on request.
Panorays — the monitoring engine
From a slow, manual questionnaire to a live risk score per supplier.
Panorays automates third-party risk assessment by combining external cyber-posture data, questionnaire-based control validation and continuous monitoring into a single risk score per supplier. Passeca implements and operates Panorays so a vendor-review process that used to take weeks per supplier runs continuously across the whole estate — and feeds straight into your NIS2 and DORA evidence.
How Passeca runs a third-party risk programme
- 01
Vendor inventory & criticality
We inventory your ICT suppliers and score their criticality — the starting point for both NIS2 and DORA. The inventory provides a foundation for the DORA register of information, where applicable.
- 02
Regulatory mapping
We map each critical vendor to the obligations that apply — NIS2 supply-chain security, DORA Article 28–44 for financial entities, ISO 27001 supplier controls — so you know exactly what each relationship requires.
- 03
Risk assessment on Panorays
We deploy Panorays to assess each vendor automatically — external posture, questionnaire-based controls and continuous monitoring — turning a slow, manual process into a live risk score per supplier.
- 04
Contracts & remediation
We embed the required contractual clauses (DORA, data-protection terms), flag the vendors that fail their assessment, and drive remediation with the supplier or an exit strategy where remediation fails.
- 05
Continuous monitoring
We keep Panorays running so a vendor's risk score updates as its external posture and breach history change — alerting you before a supplier compromise becomes your incident.
What you get from the engagement
Manual questionnaires vs continuous monitoring
Why a point-in-time questionnaire is no longer enough.
| Manual questionnaire | Panorays (continuous) | |
|---|---|---|
| Assessment depth | Self-reported | Posture + controls |
| Cadence | Annual | Continuous |
| Detects supplier breach | ||
| External posture data | ||
| Effort per supplier | High | Low |
| Scales to 100s of vendors | ||
| DORA / NIS2 evidence-ready | Manual export |
Manual questionnaires capture what a supplier claims at a point in time. Panorays combines supplier-provided information with external security data to support ongoing monitoring and NIS2 and DORA compliance efforts.
Third-party risk, answered
The questions buyers ask when NIS2 or DORA makes supply-chain risk mandatory.
What is third-party risk management?
What do NIS2 and DORA require for supply-chain security?
What is the DORA register of information?
What is Panorays and why does Passeca use it?
How is third-party risk different from vendor management?
How often should third-party risk be assessed?
Does ISO 27001 cover third-party risk?
How much does a third-party risk programme cost?
Can you produce your register of information?
Book a free scoping call. We will inventory your ICT suppliers, map the NIS2 and DORA obligations, and stand up Panorays so your supply-chain risk is live — not last year's questionnaire.
Related