For years, the process of managing vendor risk was often treated as a peripheral administrative task. Organisations typically relied on annual, spreadsheet-based questionnaires that were filed away and rarely revisited. In this "point-in-time" model, supply chain security was viewed as an internal best practice rather than a critical regulatory requirement.
However, as of 2026, this approach is no longer legally or operationally defensible. The convergence of an increasingly sophisticated threat landscape and the full enforcement of the European Union’s NIS 2 Directive has transformed Third-Party Risk Management (TPRM) from a "nice-to-have" checklist into a strict legal mandate. For small and medium-sized enterprises (SMEs) across Europe, the implications are profound: failing to secure the supply chain is no longer just a security risk; it is a threat to the organisation’s legal standing and its ability to participate in the European digital economy.
Defining Modern Third-Party Risk Management (TPRM)
Third-Party Risk Management is the systematic process of identifying, assessing, and mitigating the risks that arise when an organisation outsources business functions or utilises external service providers. In the modern digital ecosystem, these dependencies range from critical cloud infrastructure and Software-as-a-Service (SaaS) platforms to managed service providers (MSPs) and specialised consultants.In the context of cybersecurity and Governance, Risk, and Compliance (GRC), a robust TPRM program must ensure that third parties do not introduce vulnerabilities into the organisation’s network or compromise its data integrity. Unlike traditional procurement checks, modern TPRM requires:
- Continuous Monitoring: Moving beyond annual audits to real-time oversight of a vendor’s security posture.
- Risk-Based Tiering: Categorising vendors based on the criticality of the service and the sensitivity of the data they process.
- Contractual Enforcement: Embedding specific security SLAs, incident notification windows, and audit rights into legal agreements.
The EU Threat Landscape: Why Regulators Are Cracking Down
The shift toward mandatory TPRM is a direct response to a fundamental change in how cyberattacks are executed. Adversaries have realised that attacking a single, widely-used service provider is far more efficient than targeting hundreds of well-defended enterprise clients individually. By compromising one "link" in the chain, they gain trusted access to an entire downstream ecosystem.
A prime example of this industrialised strategy is documented in the ENISA Threat Landscape 2025 report regarding the Telemaco platform breach in the Italian transport sector. Instead of attacking individual rail or bus operators, threat actors compromised the external IT provider managing the sector’s shared ticketing and reservation infrastructure. Because multiple organisations relied on this single dependency, the breach triggered a cascading failure that paralysed ticketing systems for thousands of commuters across the region. Under the NIS 2 Directive, such incidents demonstrate that an Essential Entity is now legally responsible for the security posture of its third-party service providers, as a failure at the vendor level is now viewed as a failure of the entity’s own risk management.
Key Data from the European Market
According to the ENISA Threat Landscape 2025 report, which analysed nearly 4,900 incidents within the EU, there has been a significant "surge in the abuse of cyber dependencies." Attackers are increasingly targeting the digital supply chain, specifically software repositories and service providers, to amplify the impact of their campaigns.
Is your company under the NIS 2 scope?
A practical guide to determining your organisation's classification under the EU's updated cybersecurity directive.
The NIS 2 Ripple Effect: Why SMEs Are Not Exempt
The NIS 2 Directive officially applies to Essential and Important entities in critical sectors like energy, healthcare, banking, and digital infrastructure. While many SMEs fall below the size thresholds for direct regulation (typically 50 employees or €10 million in turnover), they are effectively "dragged" into compliance through a supply chain ripple effect.
Article 21: The Mandate for Supply Chain Security
Under Article 21(d) of the NIS 2 Directive, regulated entities are legally required to address "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers."This means that a regulated enterprise (e.g., a large hospital or a regional energy grid) cannot be compliant unless its vendors are also secure. Consequently, these large entities are now legally forced to:
- Audit their suppliers: Demand proof of security controls, vulnerability management, and incident response capabilities.
- Impose contractual obligations: Require vendors to adhere to specific cybersecurity standards.
- Terminate non-compliant partners: If an SME cannot prove its security posture, the regulated client may be legally obligated to terminate the contract to protect its own compliance status.
For the SME, NIS 2 compliance has shifted from a regulatory burden to a commercial prerequisite. In the 2026 market, an SME that cannot provide an audit-ready security pack is a liability that enterprise procurement teams will increasingly avoid.
Continuous Monitoring for ISO 27001 and NIS 2
Learn what ongoing compliance means for ISO 27001 and NIS 2
Board-Level Accountability and the Cost of Non-Compliance
One of the most significant changes introduced by NIS 2 is the end of plausible deniability for senior leadership. Cybersecurity is no longer an IT problem; it is a boardroom accountability issue.
1. Financial Penalties
The financial risks associated with non-compliance are substantial and designed to ensure executive attention. Under NIS 2, Member States must ensure that administrative fines are effective, proportionate, and dissuasive.- Essential Entities: Fines up to €10 million or 2% of total global annual turnover, whichever is higher.
- Important Entities: Fines up to €7 million or 1.4% of total global annual turnover, whichever is higher.
2. Personal Liability for Management
Under Article 20, Member States must ensure that management bodies can be held personally liable for breaches of their duty to implement risk management measures. This includes the implementation of supply chain oversight. In cases of gross negligence, national authorities have the power to:- Temporarily prohibit individuals from exercising managerial functions at the CEO or senior executive level.
- Mandate public disclosure of the non-compliance, which can lead to catastrophic reputational damage.
The Digital Operational Resilience Act (DORA) and the Financial Sector
While NIS 2 sets the baseline for the broader economy, the financial sector is governed by the even more granular Digital Operational Resilience Act (DORA). As of 2026, financial entities are required to manage ICT (Information and Communication Technology) third-party risk as a core operational risk.
The Register of Information (RoI)
DORA requires financial institutions to maintain a detailed Register of Information that documents every ICT third-party service provider. This register must include:- Details on all direct and indirect (sub-contractor) relationships.
- Criticality assessments for each service.
- Data sovereignty and location details.
In March 2026, the European Supervisory Authorities (ESAs) initiated the first full-scale collection of these registers. For SMEs supplying the financial sector, this means they will face constant, standardised requests for data that go far beyond basic security questionnaires.
Exit Strategies and Substitutability
DORA also mandates that firms have clear exit strategies for critical ICT vendors. If an SME provides a critical service but cannot demonstrate how its client would transition to another provider in the event of a failure, it may be deemed too high a risk for the financial entity to maintain.
Operational Roadblocks: Why TPRM is Difficult for SMEs
Despite the clear legal mandate, building a defensible TPRM program presents significant operational challenges for smaller organisations with limited resources.
1. The Scoping and Visibility Gap
Most organisations suffer from Shadow IT, where departments procure SaaS tools without central oversight. Without a comprehensive inventory of all third-party relationships, including non-obvious ones like payroll providers or marketing automation tools, it is impossible to manage risk or demonstrate compliance.
2. The Failure of Manual Processes
The spreadsheet era of GRC is fundamentally incompatible with modern requirements. Manual assessments are:- Resource Intensive: They consume hundreds of hours of manual follow-up.
- Prone to Human Error: Risk scores are often subjective and inconsistent.
- Static: They provide a snapshot of risk that is outdated the moment the document is saved.
3. Contractual Re-negotiation
NIS 2 and DORA require specific language in contracts (e.g., 24-hour incident notification windows). Small SMEs often lack the legal leverage to force large providers to accept these terms, leading to contractual gridlock where the organisation is left in a state of technical non-compliance.
How to Build a Defensible TPRM Strategy
To achieve compliance without overwhelming the security team, SMEs must adopt a structured, risk-based approach to vendor management.
Step 1: Implement Risk-Based Tiering
Not every vendor requires the same level of scrutiny. Organisations should categorise their supply chain into tiers:- Tier 1 (Critical): High-risk vendors with access to production systems or PII (e.g., cloud hosting, MSPs). These require continuous monitoring and deep audits.
- Tier 2 (Significant): Vendors who support key business functions but have limited access (e.g., CRM systems). These require annual assessments.
- Tier 3 (General): Low-risk vendors (e.g., office supplies). These can be managed through simple self-attestations.
Step 2: Leverage Existing Frameworks
Avoid reinventing the wheel. If an organisation is already certified under ISO 27001, the groundwork for NIS 2 compliance is largely in place. Annex A.5.19-23 of ISO 27001:2022 specifically addresses supplier relationships. By mapping these existing controls to the requirements of NIS 2 and DORA, organisations can reduce redundant work and accelerate their audit readiness.
Step 3: Transition to Continuous Monitoring
In 2026, regulators expect organisations to know if a vendor’s security posture changes today, not next year. This requires moving toward automated workflows that can:
- Track vendor breach notifications in real-time.
- Automatically flag vendors who fall out of compliance with security SLAs.
- Centralise all evidence, certificates, audit reports, and contracts in an audit-ready digital repository.
Conclusion: The New Standard for Digital Resilience
The transition from voluntary to mandatory Third-Party Risk Management marks a turning point in European cybersecurity. The NIS 2 Directive and DORA have codified a simple truth: an organisation’s resilience is only as strong as the weakest link in its supply chain.
For European SMEs, the goal is no longer just checking a box for a client. It is about building a scalable, defensible strategy that protects the organisation from personal executive liability, catastrophic fines, and the loss of critical enterprise contracts. By professionalising vendor management and moving away from fragmented manual processes, SMEs can not only meet their legal obligations but also position themselves as trusted, resilient partners in the European market.
