NIS2 is no longer a future requirement. As of June 2026, 23 out of 27 EU Member States have transposed the NIS2 Directive into national law, allowing national authorities to begin enforcement activities. While implementation timelines may vary across jurisdictions, the direction is clear: organizations within the scope of NIS2 are expected to demonstrate compliance with its cybersecurity requirements and one of the most significant aspects of NIS2 is its focus on supply chain security. Regulators increasingly recognize that cybersecurity risks do not stop at organizational boundaries. As a result, organizations are
asking an important question:
“What does NIS2 require us to do regarding Third-Party Risk Management (TPRM)?”
The answer is both simple and nuanced. NIS2 does not explicitly require organizations to establish a standalone TPRM program. However, it does require organizations to identify and manage cybersecurity risks arising from suppliers and service providers as part of their overall cybersecurity risk management framework.
Why NIS2 Matters for TPRM
The primary connection between NIS2 and third-party risk management can be found in
Article 21(2)(d), which requires organizations to implement appropriate and proportionate
cybersecurity risk management measures:
“Supply chain security, including security-related aspects concerning the relationships
between each entity and its direct suppliers or service providers.”
This is a clear signal from regulators that cybersecurity is no longer viewed solely as an internal responsibility. Organizations are expected to understand how their suppliers could impact their security posture and take reasonable steps to manage those risks.
Four Steps Organizations Should Take to Align TPRM with NIS2
Know Your Suppliers
The first step is to establish and maintain an inventory of suppliers, including cloud providers, managed service providers, software vendors, outsourcing partners, and other third parties that support critical business operations. Organizations should understand what services each supplier provides, what systems or data they can access, and how dependent the business is on them. This inventory should also identify suppliers that support critical business processes or have access to sensitive information and systems.
Without visibility into the supplier ecosystem, effective supply chain risk management
becomes impossible because organizations cannot manage risks they cannot see.
2. Establish Governance for Third-Party Risk
NIS2 expects organizations to manage supplier-related cybersecurity risks as part of their overall cybersecurity risk management framework. After identifying your suppliers, the next step is establishing a governance structure that defines how third-party risks will be evaluated, managed, and reported. This should include:
- Roles and responsibilities for managing supplier risk
- Risk appetite and risk tolerance levels
- Supplier risk classification criteria
- Assessment and reassessment requirements
- Risk acceptance and escalation procedures
- Reporting mechanisms to management
By establishing clear governance, organizations can ensure supplier-related decisions are made consistently and that resources are focused on the suppliers that introduce the greatest risk to the organization.
3. Assess Supplier Risk
Not all suppliers present the same level of risk. Based on the governance you have established, organizations should adopt a risk-based approach to assessing suppliers, focusing greater attention on those that support critical services, have access to sensitive information, or could significantly impact operations if compromised.
Assessment activities may include:
- Security questionnaires
- Evidence reviews
- Certification validation
- Independent audit reports
- Technical security assessments
Organizations should also establish appropriate cybersecurity requirements within supplier contracts, including incident notification obligations, business continuity expectations, audit rights, data protection requirements, and security-related responsibilities. The objective is to obtain sufficient assurance that suppliers can manage cybersecurity risks at a level consistent with the organization’s risk appetite.
4. Monitor and Respond
Supplier risk management does not end once a contract is signed. Organizations should continuously monitor suppliers for changes in their security posture, emerging vulnerabilities, security incidents, or other factors that could affect risk levels. This may include periodic reassessments, external monitoring, certification reviews, and supplier performance reviews.
Organizations should also ensure that critical suppliers are incorporated into incident response and business continuity planning activities in line with Article 23 reporting obligations. Clear escalation procedures, communication channels, and response expectations should be established before an incident occurs. By maintaining ongoing oversight, organizations can identify and address supply chain risks before they become business disruptions and demonstrate that supplier risks are being actively managed throughout the relationship lifecycle.
No time or resources?
If organizations are struggling to operationalize these requirements, 3rdComply provides a purpose-built TPRM platform designed to help organizations scale third-party risk management without significantly increasing internal resources.
Beyond onboarding, 3rdComply continuously monitors suppliers using public sources, security disclosures, news, and dark web intelligence. Dynamic risk ratings are automatically updated as new information emerges, helping organizations identify and respond to changing supplier risks more quickly.
The platform also streamlines collaboration with vendors through a dedicated assessment workspace, allowing suppliers to directly respond to questionnaires and upload supporting evidence, reducing repetitive information requests.
To ensure consistency, organizations can upload their policies, procedures, standards, control requirements, and certifications into 3rdComply. AI then builds a customized knowledge base that evaluates supplier responses against the organization’s own requirements, providing recommendations on whether suppliers meet internal standards and highlighting potential gaps for review.
For organizations with limited resources, 3rdComply also offers managed services, where our team performs assessment, monitoring, and analysis activities on your behalf, allowing internal teams to focus on reviewing results and making risk decisions.
In short, 3rdComply helps organizations build a scalable, continuous, and evidencedriven TPRM program aligned with regulatory expectations such as NIS2, while significantly reducing the operational effort required to manage supplier risk.
Final Thoughts
NIS2 reflects a growing regulatory reality, organizations are only as resilient as the suppliers they depend on. The question regulators increasingly want answered is no longer:
“How secure is your organization?”
It is:
“How do you know the organizations you depend on are secure?”
And more importantly are you ready to demonstrate that? www.3rdcomply.com