the work
supplier risk
Your suppliers' failures count as yours. Three rules ask for the same thing: know who they are, look at them in proportion, and put security in the contract.
the reality
All three rules ask for the same work, so build one register and let each rule read from it. A company under DORA should build to the DORA register and use it for everything, since that one asks for the most.
If you sell to a bank or a regulated customer, expect this page in reverse, with their terms arriving as contract changes for you to accept.
what passes along a supply chain
- contract terms, questionnaires
- your incident notices
- your data, your access
- security terms, audit rights
- their incident notices, reports
- the same terms, passed on
- often your data too
basis NIS2 Art. 21(2)(d), 21(3); GDPR Art. 28(1), 28(3), 28(4); IR 2024/2690 Annex 5.1.4 as a reference
You remain answerable either way. The Polish authority fined the customer far more than the processor in 2025.
basis DORA Art. 28(1), 30(2); NIS2 Art. 21(2)(d); GDPR Art. 28(1)
what to decide
- Who owns the registernamed owner, usually procurement or IT
- How hard to look at each tier of suppliernamed owner, approved by the board
- Which clauses are non-negotiable in new contractslegal, with the owner
- Which suppliers need an exit planoperations
basis NIS2 Art. 21(2)(d), 21(3); DORA Art. 28(3). The tiers are practice.
how hard to look at which supplier
- light
- medium
- heavy
basis working practice. No legal text sets this.
what to build
- Export every supplier from accounts payable, then add the tools in your identity provider's app list. That is your starting register.
- Mark each one: does it hold your data, can it reach your systems, would you stop without it. Anything with no marks leaves the list.
- For the marked ones, record owner, contract date, data involved, where the service runs and who to call in an incident.
- Collect the certificate or report the top ten already have and read its scope, or send a short questionnaire. Note the date.
- Write one clause set for new deals and renewals: security requirements, incident notice to you, audit or report rights, subcontractors, data return at exit.
- Set a yearly review, because a check done once and never again does not hold up.
basis NIS2 Art. 21(3); GDPR Art. 28(1), 28(3); IR 2024/2690 Annex 5.1.4, 5.2 as a reference; DORA Art. 30(2)
the evidence it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| supplier register with criticality marks | procurement or head of IT | twice a year |
| assessment records with dates | supplier's business owner | yearly for critical suppliers |
| signed processing agreements | legal or DPO | at signing and on change |
| clause set, and a list of contracts carrying it | legal | yearly |
| exit plan for critical suppliers | head of IT | yearly |
basis GDPR Art. 28(3), 5(2); DORA Art. 28(3)
what goes wrong
trusting an old relationship
A Polish customer relied on a PR firm's earlier work and did not check its ability to secure data. The case.
audit rights nobody uses
A clause only helps if someone reads the reports. Put a name and a date on it.
the certificate that covers something else
A report on one product says nothing about the service you buy. Read the scope.
free tools off the list
Accounts payable misses anything that costs nothing and still holds your data.
basis GDPR Art. 28(1), as applied by UODO on 21 July 2025; the rest is practice
what the texts leave open
- How deep to go. NIS2 speaks of direct suppliers. Subcontractors enter through your contract terms.
- Whether a supplier's certificate is enough. No text says so. Read the scope and record why you accepted it.
- Which functions count as critical or important under DORA. The test is yours to apply, and your supervisor can question it.
basis NIS2 Art. 21(2)(d); DORA Art. 28(3)
check it yourself
what each text says, for whoever checks this page
| text | says |
|---|---|
| NIS2 Art. 21(2)(d) | Supply chain security, including relationships with direct suppliers and service providers. |
| NIS2 Art. 21(3) | Take into account each direct supplier's vulnerabilities and the quality of its products and practices. |
| IR 2024/2690 Annex 5.1.4 | Listed digital providers: contract terms on security, incident notice, audit rights, vulnerabilities, subcontracting and end of contract. |
| IR 2024/2690 Annex 5.2 | Listed digital providers: a directory of suppliers. |
| DORA Art. 28(1) | You stay fully responsible when you use ICT providers. |
| DORA Art. 28(3) | A register of all ICT contracts, separating those that support critical or important functions. |
| DORA Art. 30(2) | Minimum contract terms: locations, data protection, data return, service levels, assistance. |
| GDPR Art. 28(1) | Use only processors offering sufficient guarantees. |
| GDPR Art. 28(3) | A contract with listed terms, including security, assistance and audits. |
| GDPR Art. 28(4) | The same duties passed on to any further processor, by contract. |
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Export last year's supplier payments and mark the first ten, today.