For years, the process of managing vendor risk was often treated as a peripheral administrative task. Organisations typically relied on annual, spreadsheet-based questionnaires that were filed away and rarely revisited. In this "point-in-time" model, supply chain security was viewed as an internal best practice rather than a critical regulatory requirement.
However, as of 2026, this approach is no longer legally or operationally defensible. The convergence of an increasingly sophisticated threat landscape and the full enforcement of the European Union’s NIS 2 Directive has transformed Third-Party Risk Management (TPRM) from a "nice-to-have" checklist into a strict legal mandate. For small and medium-sized enterprises (SMEs) across Europe, the implications are profound: failing to secure the supply chain is no longer just a security risk; it is a threat to the organisation’s legal standing and its ability to participate in the European digital economy.
The shift toward mandatory TPRM is a direct response to a fundamental change in how cyberattacks are executed. Adversaries have realised that attacking a single, widely-used service provider is far more efficient than targeting hundreds of well-defended enterprise clients individually. By compromising one "link" in the chain, they gain trusted access to an entire downstream ecosystem.
A prime example of this industrialised strategy is documented in the ENISA Threat Landscape 2025 report regarding the Telemaco platform breach in the Italian transport sector. Instead of attacking individual rail or bus operators, threat actors compromised the external IT provider managing the sector’s shared ticketing and reservation infrastructure. Because multiple organisations relied on this single dependency, the breach triggered a cascading failure that paralysed ticketing systems for thousands of commuters across the region. Under the NIS 2 Directive, such incidents demonstrate that an Essential Entity is now legally responsible for the security posture of its third-party service providers, as a failure at the vendor level is now viewed as a failure of the entity’s own risk management.
According to the ENISA Threat Landscape 2025 report, which analysed nearly 4,900 incidents within the EU, there has been a significant "surge in the abuse of cyber dependencies." Attackers are increasingly targeting the digital supply chain, specifically software repositories and service providers, to amplify the impact of their campaigns.
The NIS 2 Directive officially applies to Essential and Important entities in critical sectors like energy, healthcare, banking, and digital infrastructure. While many SMEs fall below the size thresholds for direct regulation (typically 50 employees or €10 million in turnover), they are effectively "dragged" into compliance through a supply chain ripple effect.
For the SME, NIS 2 compliance has shifted from a regulatory burden to a commercial prerequisite. In the 2026 market, an SME that cannot provide an audit-ready security pack is a liability that enterprise procurement teams will increasingly avoid.
One of the most significant changes introduced by NIS 2 is the end of plausible deniability for senior leadership. Cybersecurity is no longer an IT problem; it is a boardroom accountability issue.
While NIS 2 sets the baseline for the broader economy, the financial sector is governed by the even more granular Digital Operational Resilience Act (DORA). As of 2026, financial entities are required to manage ICT (Information and Communication Technology) third-party risk as a core operational risk.
In March 2026, the European Supervisory Authorities (ESAs) initiated the first full-scale collection of these registers. For SMEs supplying the financial sector, this means they will face constant, standardised requests for data that go far beyond basic security questionnaires.
DORA also mandates that firms have clear exit strategies for critical ICT vendors. If an SME provides a critical service but cannot demonstrate how its client would transition to another provider in the event of a failure, it may be deemed too high a risk for the financial entity to maintain.
Despite the clear legal mandate, building a defensible TPRM program presents significant operational challenges for smaller organisations with limited resources.
Most organisations suffer from Shadow IT, where departments procure SaaS tools without central oversight. Without a comprehensive inventory of all third-party relationships, including non-obvious ones like payroll providers or marketing automation tools, it is impossible to manage risk or demonstrate compliance.
NIS 2 and DORA require specific language in contracts (e.g., 24-hour incident notification windows). Small SMEs often lack the legal leverage to force large providers to accept these terms, leading to contractual gridlock where the organisation is left in a state of technical non-compliance.
To achieve compliance without overwhelming the security team, SMEs must adopt a structured, risk-based approach to vendor management.
Avoid reinventing the wheel. If an organisation is already certified under ISO 27001, the groundwork for NIS 2 compliance is largely in place. Annex A.5.19-23 of ISO 27001:2022 specifically addresses supplier relationships. By mapping these existing controls to the requirements of NIS 2 and DORA, organisations can reduce redundant work and accelerate their audit readiness.
The transition from voluntary to mandatory Third-Party Risk Management marks a turning point in European cybersecurity. The NIS 2 Directive and DORA have codified a simple truth: an organisation’s resilience is only as strong as the weakest link in its supply chain.
For European SMEs, the goal is no longer just checking a box for a client. It is about building a scalable, defensible strategy that protects the organisation from personal executive liability, catastrophic fines, and the loss of critical enterprise contracts. By professionalising vendor management and moving away from fragmented manual processes, SMEs can not only meet their legal obligations but also position themselves as trusted, resilient partners in the European market.