control
supplier management
A register of the suppliers that hold your data or run part of your service, a check in proportion to what each can affect, and contract terms that carry security. NIS2, DORA and GDPR all ask for it, and DORA asks for the most.
- what it protects
- the business on the day a supplier fails or is breached
- who owns it
- procurement or head of IT, with legal for the contract terms
- start with
- accounts payable and the app list, then mark the suppliers that hold your data
what it is
Supplier management keeps three things in one place: who your suppliers are, how closely you checked them and what the contract says. When a supplier fails, the customer is still answerable.
NIS2 asks for supply chain security and names direct suppliers. DORA asks for a register of all ICT contracts and sets minimum contract terms. GDPR asks for a processing agreement with any supplier that handles personal data for you. One register can serve all three. If DORA applies to you, build to its register, since it asks for the most.
Begin with accounts payable and the identity provider’s app list. Mark the suppliers that hold your data, can reach your systems or would stop the business if they failed. Check those first, in proportion, and keep the dates.
basis NIS2 Art. 21(2)(d), 21(3); DORA Art. 28(3), 30(2); GDPR Art. 28(3). The tiers are practice.
from a supplier on the list to a supplier you can leave
- 1listevery supplier from accounts payable and the app list, each with an owner
- 2tiermark those that hold your data, reach your systems or would stop the business
- 3checkdepth in proportion to the tier, dated, with the scope read
- 4contractsecurity terms, processing agreement, subcontractor duty, audit rights
- 5exita written way out for each critical supplier
how deep the check goes, by tier
- holds nothing sensitiveregister entry and the contract dates
- holds your data or reaches your systemsquestionnaire, certificate with its scope, processing agreement
- critical to the businessreports read, audit right used, incident contact tested, exit plan written
basis working practice. No legal text sets this.
an example
Picture a company of 300 people with forty suppliers on the payment list.
Nobody knows which of them hold customer data. A certificate from three years ago is filed for the hosting provider and it covers a different product. When the provider has an outage, nobody has a contact or a way out.
Suppliers are tiered by what they can affect. The critical few have dated checks, a processing agreement, a named incident contact and a written exit plan. Free tools found in the app list are on the register too.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| NIS2 | NIS2 Art. 21(2)(d) | Supply chain security, including relationships with direct suppliers and service providers. | Keep a register of direct suppliers and mark the ones that hold your data or that you could not run without. |
| NIS2 | NIS2 Art. 21(3) | Take into account each direct supplier's vulnerabilities and the quality of its products and practices. | Check each marked supplier in proportion to what it can affect, and record the date and the result. |
| IR 2024/2690 | IR 2024/2690 Annex 5.2 | Listed digital providers: a directory of suppliers. | Hold the directory in the same register and update it when contracts change. |
| DORA | DORA Art. 28(3) | A register of all ICT contracts, separating those that support critical or important functions. | Keep every ICT contract in one register and mark the ones behind critical or important functions. |
| DORA | DORA Art. 30(2) | Minimum contract terms: locations, data protection, data return, service levels, assistance. | Hold one clause set for these terms and track which contracts carry it. |
| GDPR | GDPR Art. 28(3) | A contract with listed terms, including security, assistance and audits. | Sign a processing agreement with every supplier that handles personal data on your behalf, and file it with the register. |
| GDPR | GDPR Art. 28(4) | The same duties passed on to any further processor, by contract. | Ask each supplier which subcontractors it uses, and write the duty to pass terms on into the contract. |
basis NIS2 Art. 21(2)(d), 21(3); IR 2024/2690 Annex 5.2 as a reference; DORA Art. 28(3), 30(2); GDPR Art. 28(3), 28(4). What the control has to do is practice.
what to look for when you choose
- Can each supplier carry an owner, the data it holds, where the service runs, the contract dates and who to call in an incident?
- Can you mark which suppliers are critical, and does the mark drive the depth of the check?
- Does it hold the evidence you collect, such as certificates, reports and questionnaires, with the date and the scope each one covers?
- Does it remind you of renewals, review dates and expiring certificates?
- Does it track subcontractors and where data is processed?
- Can it show which contracts carry your clause set and which do not?
- Can it record an exit plan for each critical supplier?
- Can you export the register in the form a regulator or a customer asks for?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
Build the list from accounts payable and the app list, and mark the suppliers that hold your data or would stop the business.
- solid
Check the marked suppliers in proportion, read the scope of each certificate, and keep one clause set and a list of the contracts that carry it.
- strong
Track subcontractors and data locations, use the audit rights, test the incident contact and write an exit plan for each critical supplier.
basis working practice. No legal text sets this.
where it goes wrong
trusting an old relationship
A supplier you have used for years was checked once, at the start. Check again when the data it holds changes.
the certificate that covers something else
A report on one product says nothing about the service you buy. Read the scope.
free tools off the list
Accounts payable misses anything that costs nothing and still holds your data. Add the identity provider's app list.
audit rights nobody uses
A clause only helps if someone reads the reports. Put a name and a date on it.
no way out
A critical supplier with no exit plan leaves you stuck on the day it fails. Write the plan before you need it.
basis working practice. No legal text sets this.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| supplier register with criticality marks | procurement or head of IT | twice a year |
| assessment records with dates and the scope reviewed | the supplier's business owner | yearly for critical suppliers |
| signed processing agreements | legal or data protection officer | at signing and on change |
| clause set and a list of the contracts that carry it | legal | yearly |
| exit plan for each critical supplier | head of IT | yearly |
basis practice. The rhythms are your choice.
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
your next step
Export last year's supplier payments and mark the first ten that hold your data.