NIS2 Has Redefined What “Good” Third-Party Risk Management Looks Like
NIS2 has not introduced third-party risk management as a new concept. Instead, it has redefined the expected baseline of maturity. Under traditional cybersecurity and vendor risk programs, third-party risk management was typically built around periodic assessments. Organizations maintained supplier inventories in spreadsheets, sent annual security questionnaires, and reviewed critical vendors on a fixed cycle. Risk was treated as relatively static, updated at onboarding or during annual reviews. Under Article 21(2)(d) of Directive (EU) 2022/2555 (NIS2), organizations are required to implement cybersecurity
risk management measures that explicitly include:
“Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.”
This requirement is further operationalized through the Commission Implementing Regulation (EU) 2024/2690, which provides detailed technical and methodological requirements for how supply chain security and broader Article 21 controls must be implemented in practice. The regulation moves expectations from high-level principles to auditable, operational controls across supplier selection, contracting, and monitoring.
This is important because it expands responsibility beyond internal systems. It requires organizations to actively consider, structure, and continuously manage risks introduced through their supply chain as part of their cybersecurity posture.
The practical shift can be summarized simply:
- Legacy model: periodic vendor assessment and annual review cycles
- NIS2 + Implementing Regulation model: continuous, risk-based, and evidencedriven supplier risk management with defined technical controls
Why Legacy TPRM Processes No Longer Hold Up
Most existing TPRM programs were not designed for the operational reality introduced by NIS2 and the implementing regulation. They rely heavily on fragmented and manual processes: spreadsheets for vendor inventories, email-based questionnaires for assessments, and distributed documentation across procurement, security, and compliance teams. This introduces several fundamental limitations under NIS2.
The first limitation is lack of real-time visibility. Supplier risk information is often outdated as soon as it is captured. NIS2, particularly through Article 21, expects organizations to implement “appropriate and proportionate” risk management measures. In practice, this implies ongoing awareness of current risk conditions. When organizations rely on static records, they are operating with a delayed view of their supply chain exposure.
The second limitation is lack of scalability. Modern organizations may manage hundreds or even thousands of third-party relationships. Manual TPRM processes do not scale without significant overhead, often forcing teams to focus only on a subset of “critical” suppliers. However, Article 21(2)(d) and the Implementing Regulation (EU) 2024/2690 explicitly require structured supplier security governance, including defined supplier selection criteria and ongoing supply chain security controls.
The third limitation is fragmented audit evidence. Under NIS2, organizations must demonstrate that cybersecurity risk management measures are not only defined but actively implemented. The implementing regulation further reinforces this by requiring structured documentation of supplier registries, security requirements in contracts, and supply chain governance processes. When this evidence is spread across disconnected tools, producing consistent, audit-ready output becomes manual and error-prone.
The fourth limitation is lack of continuous monitoring. Traditional TPRM is fundamentally point-in-time. Once a supplier is assessed, it is often not revisited until the next cycle. This creates a blind spot in detecting changes in supplier risk posture, such as security incidents, certification lapses, or infrastructure changes.
Together, these limitations create a gap between operational reality and regulatory expectation.
Why Organizations Need Support from TPRM Platforms
The platform enables organizations to perform supplier assessments more efficiently, maintain ongoing visibility into supplier risk through continuous monitoring, and simplify vendor engagement through a centralized assessment portal. By leveraging AI, organizations can also assess suppliers against their own policies, standards, and control requirements, ensuring greater consistency across the assessment process.
Rather than replacing existing procurement, vendor management, or GRC systems, 3rdComply is designed to complement them. The platform acts as a productivity layer that helps organizations automate time-consuming assessment activities, centralize supplier intelligence, and reduce the manual effort required to collect, review, and analyze supplier risk information while continuing to leverage existing processes and systems.
For organizations with limited capacity, 3rdComply managed services can take care of assessment, monitoring, and analysis activities, allowing internal stakeholders to focus on reviewing risks and making informed decisions. 3rdComply helps organizations establish a more scalable, risk-based, and continuously monitored TPRM program that aligns with evolving regulatory expectations such as NIS2.
The goal is not only operational efficiency but alignment with regulatory expectations, particularly the requirement to operationalize supply chain security through structured, repeatable, and auditable controls across the supplier lifecycle.
Final Thoughts
NIS2 does not introduce third-party risk management. It raises the baseline for how it must be executed. The shift from periodic assessments to continuous, risk-based supply chain security means that many legacy TPRM programs are no longer aligned with regulatory expectations.
As organizations reassess their capabilities, the question is no longer whether they manage supplier risk. It is whether their current approach can continuously demonstrate that supplier risk is understood, controlled, and evidenced in line with both the Directive and its implementing regulation.
For many organizations, this is where traditional processes reach their limit and where platforms like 3rdComply become a practical enabler of compliance at scale.