Third-party risk management (TPRM): your digital supply chain under control

Article 28 of the DORA Regulation sets specific obligations: maintain a detailed register of ICT vendors, classify the criticality of each arrangement, assess concentration and dependencies, apply minimum contractual clauses, guarantee audit rights and have documented exit plans for critical vendors. The entity remains responsible even when outsourcing, and must be able to demonstrate it to the competent supervisor.

Traditional vendor management focuses on operational SLAs, billing and performance. TPRM adds the cybersecurity and regulatory risk dimension: what data the vendor processes, what controls it applies, what sub-processors it uses, what happens if it suffers a breach, how to exit the contract if needed. They are complementary disciplines and a mature programme integrates both.

It depends on the applicable framework. DORA requires complete coverage of the ICT inventory with reinforced focus on critical ones. NIS2 asks for proportionality to the organisation's profile. ISO 27001 requires treating all vendors relevant to information security. In practice, an honest first sweep usually uncovers 30 to 60 per cent more vendors than the organisation formally inventoried.

To start and for mid-sized programmes, a well-structured spreadsheet can sustain the programme for the first months. When the inventory exceeds 50-80 vendors, when there are several business units or when audits require granular traceability, a GRC platform helps to scale. What matters is the operating model, not the tool.

An exit plan documents how to end the relationship with a critical vendor without service disruption: viable technical alternatives, realistic timelines, data portability, information ownership, associated costs and owners. DORA requires it because technological dependency is a systemic risk: without a credible exit plan, a financial entity can be trapped with a vendor that fails or stops complying.

It is a frequent situation with large hyperscalers and mass-market SaaS providers. The real options are: accept the limitation by documenting the residual risk and applying compensating controls, negotiate specific addenda, evaluate vendor substitution or, in regulated sectors, escalate the decision to the governance body with impact analysis.

They reduce the effort but do not replace it. A certification verifies that a management system exists, not that it applies to the specific service you are contracting. Due diligence must confirm scope, data processed, specific configuration and incident response — aspects the certification does not detail on its own.

The most useful metrics are inventory coverage, percentage of critical vendors with current due diligence, mean review time, number of material findings detected, vendors with open improvement plan and vendors with documented exit plan. Comparable indicators over time that the committee understands without technical translation.