After reading, you can organise the whole supplier lifecycle, from the first list to a workable exit.
Definition
Its concerns include cybersecurity, continuity, legal and financial risk. For financial entities, DORA Articles 28 to 30 set detailed rules on ICT third-party risk, including a register of contracts and exit strategies.
Why it matters
Essential functions now run on outside services, so an incident at a supplier quickly becomes your own.
Regulators have noticed. NIS2 requires measures on supply chain security, and customers pass such requirements on by contract.
How it works
Keep one inventory of third parties, showing the owner, the service, the data involved and the tier.
Assess before signing, and write security requirements, audit rights, incident notice and exit terms into the contract.
Over time, monitor with periodic reviews and alerts. For critical suppliers, prepare the exit: data return and a replacement option.
A worked case
An insurer lists 240 third parties, 18 of which support critical functions. It registers those under DORA, adds audit and exit clauses at renewal, and reviews them each year.
When a broker portal provider announces a breach, the inventory shows within the hour which data is concerned and who owns the relationship.
Good practices
- Give each relationship one business owner.
- Connect the programme to purchasing, so that no supplier slips past it.
- Set the depth of review by tier.
- Walk through the exit plan for critical suppliers, on paper at the very least.
Common mistakes
- Having no full list of suppliers, usually because departments buy their own tools.
- Leaving contracts without security clauses, which leaves you little to rely on after an incident.
- Putting all the effort into onboarding and none into the years that follow.
Questions
- What is concentration risk?
- The risk of relying on one supplier, or on several that rely on the same underlying one, so that a single failure hits many services at once.
- Does DORA apply to every company?
- No. It applies to financial entities and their critical ICT providers, though other suppliers feel it through contract requirements.
- Who owns the third-party risk programme?
- Often security, risk or purchasing. Each relationship still needs a business owner who answers for the service.
- What should a supplier contract include?
- Security requirements, incident notice, audit or evidence rights, subcontracting rules, data location and exit terms.
- What tools does third-party risk management need?
- A maintained register is the start. Dedicated platforms and security rating services help at volume.