{"id":694,"date":"2026-07-21T21:00:00","date_gmt":"2026-07-21T21:00:00","guid":{"rendered":"https:\/\/3rdcomply.com\/blog\/?p=694"},"modified":"2026-07-06T05:15:22","modified_gmt":"2026-07-06T05:15:22","slug":"nis2-third-party-risk-management","status":"publish","type":"post","link":"https:\/\/3rdcomply.com\/blog\/2026\/07\/21\/nis2-third-party-risk-management\/","title":{"rendered":"NIS2 Is Live. What Organizations Need to Do About Third-Party Risk Management"},"content":{"rendered":"\n

NIS2 is no longer a future requirement. As of June 2026, 23 out of 27 EU Member States have transposed the NIS2 Directive into national law, allowing national authorities to begin enforcement activities. While implementation timelines may vary across jurisdictions, the direction is clear: organizations within the scope of NIS2 are expected to demonstrate compliance with its cybersecurity requirements and one of the most significant aspects of NIS2 is its focus on supply chain security. Regulators increasingly recognize that cybersecurity risks do not stop at organizational boundaries. As a result, organizations are
asking an important question:<\/p>\n\n\n\n

\u201cWhat does NIS2 require us to do regarding Third-Party Risk Management (TPRM)?\u201d<\/strong><\/p>\n\n\n\n

The answer is both simple and nuanced. NIS2 does not explicitly require organizations to establish a standalone TPRM program. However, it does require organizations to identify and manage cybersecurity risks arising from suppliers and service providers as part of their overall cybersecurity risk management framework.<\/p>\n\n\n\n

Why NIS2 Matters for TPRM<\/h2>\n\n\n\n

The primary connection between NIS2 and third-party risk management can be found in
Article 21(2)(d)<\/strong>, which requires organizations to implement appropriate and proportionate
cybersecurity risk management measures:<\/p>\n\n\n\n

\n

\u201cSupply chain security, including security-related aspects concerning the relationships
between each entity and its direct suppliers or service providers.\u201d<\/p>\n<\/blockquote>\n\n\n\n

This is a clear signal from regulators that cybersecurity is no longer viewed solely as an internal responsibility. Organizations are expected to understand how their suppliers could impact their security posture and take reasonable steps to manage those risks.<\/p>\n\n\n\n

Four Steps Organizations Should Take to Align TPRM with NIS2<\/h2>\n\n\n\n

Know Your Suppliers<\/strong><\/p>\n\n\n\n

    <\/ol>\n\n\n\n

    The first step is to establish and maintain an inventory of suppliers, including cloud providers, managed service providers, software vendors, outsourcing partners, and other third parties that support critical business operations. Organizations should understand what services each supplier provides, what systems or data they can access, and how dependent the business is on them. This inventory should also identify suppliers that support critical business processes or have access to sensitive information and systems.<\/p>\n\n\n\n

    Without visibility into the supplier ecosystem, effective supply chain risk management
    becomes impossible because organizations cannot manage risks they cannot see.<\/p>\n\n\n\n

    2. Establish Governance for Third-Party Risk<\/strong><\/p>\n\n\n\n

    NIS2 expects organizations to manage supplier-related cybersecurity risks as part of their overall cybersecurity risk management framework. After identifying your suppliers, the next step is establishing a governance structure that defines how third-party risks will be evaluated, managed, and reported. This should include:<\/p>\n\n\n\n