The third-party risk management tool that links your vendors to your assets and your business

A third party is any external organisation whose relationship with you creates exposure: supplier, service provider, partner, reseller. A processor, in GDPR terms, is the one handling personal data on your behalf, which calls for a contract governing that processing. Critical supplier covers two different things: the criticality you assign yourself, usually from the critical or important functions the provider underpins, and, under DORA, the critical ICT third-party service provider, designated at European level by the supervisory authorities. One provider can fall under all three readings.

No single text imposes it, yet several regimes lead there. NIS2 lists supply chain security, including the relationships with direct suppliers and service providers, among the risk management measures expected from entities in its scope. DORA devotes an entire chapter to ICT third-party risk. The GDPR requires a written contract with every processor, whatever your sector. ISO/IEC 27001 stays voluntary: its supplier relationship controls bind you only if you hold the certificate or a customer demands it.

It is useful evidence, not a complete answer. A certificate covers a declared scope, which does not necessarily include the service you buy or the site where your data is processed: check that scope, the validity dates and the issuing body, whose accreditation can be verified, then ask for the statement of applicability. A SOC 2 report or a SecNumCloud qualification is read the same way. Such documents reduce the assessment effort, they do not replace your own analysis of the risk this supplier poses to your operations.

No, and trying to is the surest way to assess none of them properly. Tiering rests on observable criteria: the nature of the data entrusted, the access granted to your systems, operational dependence, how easily the supplier could be replaced, and the depth of the subcontracting chain behind the contract. A health data hosting provider and an office supplies vendor do not warrant the same questionnaire. What an auditor looks for is a tiering rule that is written down, applied, and revisited when the contract or the usage changes.

Through the contract first, through evidence afterwards. The GDPR forbids your processor from engaging another processor without your prior written authorisation, and requires the same data protection obligations to be passed down the chain. DORA goes further for critical or important functions: subcontracting conditions belong in the contract, and the chain has to be documented and monitored. In practice, ask for the list of subcontractors and its updates, require notice before any change, and check where the data is actually processed. A second-tier dependency is still your risk.

These are two distinct families of tools, often confused at selection time. Data governance answers internal questions: what data exists, where it sits, who accesses it, on what legal basis. Third-party risk management answers an external one: how much risk does this organisation pose to your operations, and what evidence establishes it. They meet on the inventory, but a data catalogue produces no supplier assessment, no treatment plan and no audit trail a regulator can follow. If your driver is regulatory (NIS2, DORA), the second one is what you need.

Because a vendor assessment is not a deliverable, it is a cycle. A spreadsheet freezes one snapshot at one date: it will not tell you what changed since the previous campaign, who accepted a given gap and for how long, or which security clauses are up for renegotiation. The day a regulator or a customer asks you to reconstruct a decision taken two years ago, that history is exactly what is missing. A platform keeps those links, records the trade-offs and replays the full thread. At Vailor, the third-party register linked to your assets is available now, and AI-analysed questionnaires are planned.