{"id":697,"date":"2026-08-04T21:00:00","date_gmt":"2026-08-04T21:00:00","guid":{"rendered":"https:\/\/3rdcomply.com\/blog\/?p=697"},"modified":"2026-07-06T05:36:17","modified_gmt":"2026-07-06T05:36:17","slug":"legacy-tprm-processes-nis2","status":"publish","type":"post","link":"https:\/\/3rdcomply.com\/blog\/2026\/08\/04\/legacy-tprm-processes-nis2\/","title":{"rendered":"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes"},"content":{"rendered":"\n<p class=\"has-primary-color has-text-color has-link-color wp-elements-1 wp-block-paragraph\"><strong>NIS2 Has Redefined What \u201cGood\u201d Third-Party Risk Management Looks Like<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 has not introduced third-party risk management as a new concept. Instead, it has redefined the expected baseline of maturity. Under traditional cybersecurity and vendor risk programs, third-party risk management was typically built around periodic assessments. Organizations maintained supplier inventories in spreadsheets, sent annual security questionnaires, and reviewed critical vendors on a fixed cycle. Risk was treated as relatively static, updated at onboarding or during annual reviews. Under <strong>Article 21(2)(d) of Directive (EU) 2022\/2555 (NIS2)<\/strong>, organizations are required to implement cybersecurity<br>risk management measures that explicitly include:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"has-primary-color has-text-color has-link-color wp-elements-2 wp-block-paragraph\">\u201cSupply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.\u201d<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">This requirement is further operationalized through the <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg_impl\/2024\/2690\/oj\/eng\" type=\"link\" id=\"https:\/\/eur-lex.europa.eu\/eli\/reg_impl\/2024\/2690\/oj\/eng\">Commission Implementing Regulation (EU) 2024\/2690<\/a>, which provides detailed technical and methodological requirements for how supply chain security and broader Article 21 controls must be implemented in practice. The regulation moves expectations from high-level principles to <strong>auditable, operational controls across supplier selection, contracting, and monitoring.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is important because it expands responsibility beyond internal systems. It requires organizations to actively consider, structure, and continuously manage risks introduced through their supply chain as part of their cybersecurity posture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The practical shift can be summarized simply:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Legacy model:<\/strong> periodic vendor assessment and annual review cycles<\/li>\n\n\n\n<li><strong>NIS2 + Implementing Regulation model: <\/strong>continuous, risk-based, and evidence\u0002driven supplier risk management with defined technical controls<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Legacy TPRM Processes No Longer Hold Up<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most existing TPRM programs were not designed for the operational reality introduced by NIS2 and the implementing regulation. They rely heavily on fragmented and manual processes: spreadsheets for vendor inventories, email-based questionnaires for assessments, and distributed documentation across procurement, security, and compliance teams. This introduces several fundamental limitations under NIS2.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first limitation is <strong>lack of real-time visibility<\/strong>. Supplier risk information is often outdated as soon as it is captured. NIS2, particularly through Article 21, expects organizations to implement \u201cappropriate and proportionate\u201d risk management measures. In practice, this implies ongoing awareness of current risk conditions. When organizations rely on static records, they are operating with a delayed view of their supply chain exposure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second limitation is <strong>lack of scalability<\/strong>. Modern organizations may manage hundreds or even thousands of third-party relationships. Manual TPRM processes do not scale without significant overhead, often forcing teams to focus only on a subset of \u201ccritical\u201d suppliers. However, Article 21(2)(d) and the Implementing Regulation (EU) 2024\/2690 explicitly require structured supplier security governance, including defined supplier selection criteria and ongoing supply chain security controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The third limitation is <strong>fragmented audit evidence<\/strong>. Under NIS2, organizations must demonstrate that cybersecurity risk management measures are not only defined but actively implemented. The implementing regulation further reinforces this by requiring structured documentation of supplier registries, security requirements in contracts, and supply chain governance processes. When this evidence is spread across disconnected tools, producing consistent, audit-ready output becomes manual and error-prone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fourth limitation is <strong>lack of continuous monitoring<\/strong>. Traditional TPRM is fundamentally point-in-time. Once a supplier is assessed, it is often not revisited until the next cycle. This creates a blind spot in detecting changes in supplier risk posture, such as security incidents, certification lapses, or infrastructure changes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Together, these limitations create a gap between operational reality and regulatory expectation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Organizations Need Support from TPRM Platforms<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The platform enables organizations to perform supplier assessments more efficiently, maintain ongoing visibility into supplier risk through continuous monitoring, and simplify vendor engagement through a centralized assessment portal. By leveraging AI, organizations can also assess suppliers against their own policies, standards, and control requirements, ensuring greater consistency across the assessment process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rather than replacing existing procurement, vendor management, or GRC systems, <strong><a href=\"https:\/\/3rdcomply.com\/\" type=\"link\" id=\"https:\/\/3rdcomply.com\/\">3rdComply<\/a><\/strong> is designed to complement them. The platform acts as a productivity layer that helps organizations automate time-consuming assessment activities, centralize supplier intelligence, and reduce the manual effort required to collect, review, and analyze supplier risk information while continuing to leverage existing processes and systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For organizations with limited capacity, <strong><a href=\"https:\/\/3rdcomply.com\/\" type=\"link\" id=\"https:\/\/3rdcomply.com\/\">3rdComply<\/a> <\/strong>managed services can take care of assessment, monitoring, and analysis activities, allowing internal stakeholders to focus on reviewing risks and making informed decisions. <strong>3rdComply<\/strong> helps organizations establish a more scalable, risk-based, and continuously monitored TPRM program that aligns with evolving regulatory expectations such as NIS2.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The goal is not only operational efficiency but alignment with regulatory expectations, particularly the requirement to operationalize supply chain security through structured, repeatable, and auditable controls across the supplier lifecycle.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Final Thoughts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 does not introduce third-party risk management. It raises the baseline for how it must be executed. The shift from periodic assessments to continuous, risk-based supply chain security means that many legacy TPRM programs are no longer aligned with regulatory expectations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As organizations reassess their capabilities, the question is no longer whether they manage supplier risk. It is whether their current approach can continuously demonstrate that supplier risk is understood, controlled, and evidenced in line with both the Directive and its implementing regulation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For many organizations, this is where traditional processes reach their limit and where platforms like <strong><a href=\"https:\/\/3rdcomply.com\/\" type=\"link\" id=\"https:\/\/3rdcomply.com\/\">3rdComply<\/a><\/strong> become a practical enabler of compliance at scale.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>NIS2 Has Redefined What \u201cGood\u201d Third-Party Risk Management Looks Like NIS2 has not introduced third-party risk management as a new concept. Instead, it has redefined the expected baseline of maturity. Under traditional cybersecurity and vendor risk programs, third-party risk management was typically built around periodic assessments. Organizations maintained supplier inventories in spreadsheets, sent annual security &#8230; <a title=\"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes\" class=\"read-more\" href=\"https:\/\/3rdcomply.com\/blog\/2026\/08\/04\/legacy-tprm-processes-nis2\/\" aria-label=\"Read more about Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes\">Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":699,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"class_list":["post-697","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes - Blog 3rdcomply<\/title>\n<meta name=\"description\" content=\"Spreadsheets and annual reviews no longer meet NIS2 standards. See why legacy TPRM processes fall short and what organizations need instead.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1, noarchive\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes - Blog 3rdcomply\" \/>\n<meta property=\"og:description\" content=\"Spreadsheets and annual reviews no longer meet NIS2 standards. See why legacy TPRM processes fall short and what organizations need instead.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2\" \/>\n<meta property=\"og:site_name\" content=\"Blog 3rdcomply\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-04T21:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/07\/3rdComply-blogs-19.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"3rdComply Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"3rdComply Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/2026\\\/08\\\/04\\\/legacy-tprm-processes-nis2\\\/\"},\"author\":{\"name\":\"3rdComply Admin\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb35af9c18abb4a214b43923eb82e2df\"},\"headline\":\"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes\",\"datePublished\":\"2026-08-04T21:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/2026\\\/08\\\/04\\\/legacy-tprm-processes-nis2\\\/\"},\"wordCount\":846,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/3rdComply-blogs-19.png\",\"articleSection\":[\"Compliance\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/2026\\\/08\\\/04\\\/legacy-tprm-processes-nis2\\\/\",\"url\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2\",\"name\":\"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes - Blog 3rdcomply\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/3rdComply-blogs-19.png\",\"datePublished\":\"2026-08-04T21:00:00+00:00\",\"description\":\"Spreadsheets and annual reviews no longer meet NIS2 standards. See why legacy TPRM processes fall short and what organizations need instead.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#primaryimage\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/3rdComply-blogs-19.png\",\"contentUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/3rdComply-blogs-19.png\",\"width\":1280,\"height\":720,\"caption\":\"Why legacy TPRM processes no longer hold up under NIS2\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.3rdcomply.com\\\/blog\\\/legacy-tprm-processes-nis2#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Legacy TPRM vs NIS2\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/\",\"name\":\"Blog 3rdcomply\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#organization\",\"name\":\"Blog 3rdcomply\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/cropped-3rdcomply-logo.png\",\"contentUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/cropped-3rdcomply-logo.png\",\"width\":1476,\"height\":511,\"caption\":\"Blog 3rdcomply\"},\"image\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb35af9c18abb4a214b43923eb82e2df\",\"name\":\"3rdComply Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g\",\"caption\":\"3rdComply Admin\"},\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/author\\\/alya\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes - Blog 3rdcomply","description":"Spreadsheets and annual reviews no longer meet NIS2 standards. See why legacy TPRM processes fall short and what organizations need instead.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1","archive":"noarchive"},"canonical":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2","og_locale":"en_US","og_type":"article","og_title":"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes - Blog 3rdcomply","og_description":"Spreadsheets and annual reviews no longer meet NIS2 standards. See why legacy TPRM processes fall short and what organizations need instead.","og_url":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2","og_site_name":"Blog 3rdcomply","article_published_time":"2026-08-04T21:00:00+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/07\/3rdComply-blogs-19.png","type":"image\/png"}],"author":"3rdComply Admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"3rdComply Admin","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#article","isPartOf":{"@id":"https:\/\/3rdcomply.com\/blog\/2026\/08\/04\/legacy-tprm-processes-nis2\/"},"author":{"name":"3rdComply Admin","@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/person\/bb35af9c18abb4a214b43923eb82e2df"},"headline":"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes","datePublished":"2026-08-04T21:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/3rdcomply.com\/blog\/2026\/08\/04\/legacy-tprm-processes-nis2\/"},"wordCount":846,"commentCount":0,"publisher":{"@id":"https:\/\/3rdcomply.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#primaryimage"},"thumbnailUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/07\/3rdComply-blogs-19.png","articleSection":["Compliance"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#respond"]}]},{"@type":"WebPage","@id":"https:\/\/3rdcomply.com\/blog\/2026\/08\/04\/legacy-tprm-processes-nis2\/","url":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2","name":"Why NIS2 Requires Organizations to Move Beyond Legacy TPRM Processes - Blog 3rdcomply","isPartOf":{"@id":"https:\/\/3rdcomply.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#primaryimage"},"image":{"@id":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#primaryimage"},"thumbnailUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/07\/3rdComply-blogs-19.png","datePublished":"2026-08-04T21:00:00+00:00","description":"Spreadsheets and annual reviews no longer meet NIS2 standards. See why legacy TPRM processes fall short and what organizations need instead.","breadcrumb":{"@id":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#primaryimage","url":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/07\/3rdComply-blogs-19.png","contentUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/07\/3rdComply-blogs-19.png","width":1280,"height":720,"caption":"Why legacy TPRM processes no longer hold up under NIS2"},{"@type":"BreadcrumbList","@id":"https:\/\/www.3rdcomply.com\/blog\/legacy-tprm-processes-nis2#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/3rdcomply.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Legacy TPRM vs NIS2"}]},{"@type":"WebSite","@id":"https:\/\/3rdcomply.com\/blog\/#website","url":"https:\/\/3rdcomply.com\/blog\/","name":"Blog 3rdcomply","description":"","publisher":{"@id":"https:\/\/3rdcomply.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/3rdcomply.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/3rdcomply.com\/blog\/#organization","name":"Blog 3rdcomply","url":"https:\/\/3rdcomply.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/05\/cropped-3rdcomply-logo.png","contentUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/05\/cropped-3rdcomply-logo.png","width":1476,"height":511,"caption":"Blog 3rdcomply"},"image":{"@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/person\/bb35af9c18abb4a214b43923eb82e2df","name":"3rdComply Admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g","caption":"3rdComply Admin"},"url":"https:\/\/3rdcomply.com\/blog\/author\/alya\/"}]}},"_links":{"self":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts\/697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/comments?post=697"}],"version-history":[{"count":1,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts\/697\/revisions"}],"predecessor-version":[{"id":698,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts\/697\/revisions\/698"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/media\/699"}],"wp:attachment":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/media?parent=697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/categories?post=697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/tags?post=697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}