The Hidden Cost of Vendor Trust: What NIS2 and DORA Actually Require Beyond a Checklist 

Ask most compliance teams what NIS2 or DORA requires for third-party risk, and you’ll get a version of the same answer: “We need to assess our vendors and document it.” 

Technically true. Practically incomplete. 

Both regulations were written in direct response to a pattern regulator kept seeing companies with strong internal security getting compromised through a vendor, supplier, or service provider nobody scrutinized closely enough. The checklist mentality that got us here is exactly what these frameworks are trying to move away from. 

NIS2: Supply Chain Security Is Not Optional 

NIS2 explicitly names supply chain and vendor relationships as a required part of an organization’s risk management measures. That means: 

• You need to assess the security practices of your direct suppliers and service providers. 
• You need to consider the overall quality of a vendor’s products and their vulnerability management practices. 
• You need to be able to demonstrate this assessment that happened, not just asserting that it did. 

The regulation doesn’t ask for a questionnaire on file. It asks evidence that risk was genuinely evaluated, and that the evaluation is defensible if a regulator or auditor asks to see it. 

DORA: Third-Party Risk as a Named Category, Not an Afterthought 

DORA goes further for financial entities, treating ICT third-party risk as its own dedicated pillar rather than a subsection of general risk management. Key expectations include: 

• A register of information covering all ICT third-party arrangements 
• Ongoing monitoring of critical third-party providers, not a one-time assessment 
• Contractual provisions covering audit rights, service levels, and exit strategies 
• Assessment of concentration risk if too much depends on a single provider 

Notice what’s consistent across both frameworks: the emphasis is on an ongoing, provable relationship with risk, not a static form filled out once during onboarding. 

Where Checklist-Based TPRM Falls Short 

A questionnaire completed at the start of a vendor relationship answers one question: what did this vendor claim on this specific day? It says nothing about: 

• Whether that posture has changed six months later 
• Whether the answers were backed by actual evidence or best-guess responses 
• Whether you could reproduce your assessment logic in front of a regulator 

Both NIS2 and DORA are built around continuous accountability. A single questionnaire, however detailed, is a snapshot, not a program. 

What “Provable” Vendor Trust Actually Looks Like 

Meeting the spirit of these regulations means being able to answer, at any point, “Why do we trust this vendor, and can we show our work?” That requires: 

• Evidence-backed assessments instead of self-attestation alone 
• Ongoing monitoring so risk status reflects the present, not the past 
• Clear documentation trails that hold up to regulator or auditor scrutiny 
• Consistency across your vendor portfolio, so trust isn’t judged case-by-case 

The Real Compliance Question 

NIS2 and DORA aren’t asking, “Did you send a questionnaire?” They’re asking, “Do you actually know who you’re trusting with your systems, your data, and your customers’ money, and can you prove it?” 

That’s the gap between checkbox compliance and real third-party risk management. Closing it isn’t about doing more paperwork. It’s about building a process where trust is verified, not assumed.