Third-party risk: what NIS 2 and DORA require

When it comes to third-party risk, NIS 2 and DORA require the same discipline: know your providers, assess them before signing, write security requirements into the contract, monitor them over time and prepare to replace them. NIS 2 sets the principle (Article 21), DORA spells it out for the financial sector (Articles 28 to 30, with a mandatory register of information), and the GDPR has governed processors of personal data since 2018 (Article 28). This article, which complements our guide to third-party risk management (TPRM), goes through these requirements text by text, then compares them.

An organisation that has hardened its own information system is still exposed through those who access it or host its data: managed service provider, software vendor, hosting provider, payroll provider. Verizon's 2025 Data Breach Investigations Report states that third-party involvement in breaches doubled in one year, reaching 30% of the cases studied. In France, ANSSI notes in its 2025 cyber threat overview that data exfiltrations sometimes follow the compromise of a service provider.

European lawmakers drew a simple conclusion: you can outsource a service, not the responsibility. DORA says so explicitly: a financial entity remains “fully responsible” for complying with its obligations when it uses a provider. The major incidents described in our article on supply chain attacks (SolarWinds, Kaseya, MOVEit) weighed in this shift.

Article 21(2)(d): a minimum measure

Article 21 of the NIS 2 Directive lists ten measures that essential and important entities must implement. Point (d) covers “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. Point (e) extends it to security in the acquisition, development and maintenance of systems. For a reminder of the directive's scope, see our article From NIS to NIS 2.

Article 21(3): assess each supplier

Paragraph 3 sets out what the entity must look at when choosing its measures:

• the vulnerabilities specific to each direct supplier and service provider;
• the overall quality of their products and cybersecurity practices, including their secure development procedures;
• the results of coordinated risk assessments of critical supply chains carried out at EU level (Article 22), such as the one that led to the 5G toolbox.

The directive does not say how: no list of clauses, no register format. The principle of proportionality applies, under the responsibility of management: Article 20 requires management bodies to approve the measures and oversee their implementation, and failures can make them liable (see our article on NIS 2 penalties).

Implementing Regulation 2024/2690 for digital providers

For certain digital entities (cloud computing providers, data centres, managed and managed security service providers, online marketplaces, etc.), Implementing Regulation (EU) 2024/2690 details the measures. Its supply chain section requires a dedicated security policy, supplier selection criteria, security requirements built into contracts and an up-to-date directory of suppliers and service providers. It is the best available reading grid, even for entities it does not directly cover.

Member States had to transpose NIS 2 by 17 October 2024. In France, the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which also transposes the critical entities resilience directive and the “directive” part of DORA, was adopted by the Senate on 12 March 2025. The National Assembly's special committee voted on its version on 10 September 2025, but the plenary debate has been postponed several times: on 6 October 2026, the Conference of Presidents again removed it from the agenda of 7 October.

Meanwhile, the European Commission referred France, Ireland, Spain and the Netherlands to the Court of Justice of the EU on 8 July 2026 for failing to notify transposition. And on 17 March 2026 ANSSI published the ReCyF (French cyber framework), the list of measures it recommends to meet the NIS 2 objectives, presented as a working document until the law is adopted.

Should you wait for the law before dealing with your third parties? No. The directive's requirements are known, the ReCyF shows how they are expected to be applied, and your large customers, already subject to DORA or to NIS 2 elsewhere in Europe, are sending you their questionnaires. Inventorying and assessing suppliers takes months: better to start before the obligation becomes enforceable.

Applicable since 17 January 2025, the DORA Regulation devotes its Chapter V to managing ICT third-party risk. For a bank, insurer, asset manager or payment institution, it takes precedence over NIS 2 and goes much further. Here are the essentials for third parties.

Article 28: strategy, due diligence, audit, termination, exit

• Strategy: the entity adopts a strategy on ICT third-party risk, with a policy on the use of services supporting critical or important functions, reviewed by the management body.
• Before signing: determine whether the function is critical or important, identify the risks, including the contribution to concentration risk, carry out due diligence and identify conflicts of interest.
• Security standards: only contract with providers that comply with appropriate information security standards.
• Audit: a risk-based audit frequency and scope.
• Termination: the contract must be terminable in the event of a serious breach, proven weaknesses at the provider or an obstacle to supervision.
• Exit: for critical or important functions, documented, tested and reviewed exit strategies, with transition plans.

Article 29: concentration risk

Before entrusting a critical function, the entity assesses whether it is becoming dependent on a provider that is hard to replace, or on several closely connected providers, and examines subcontracting chains, particularly outside the Union.

Article 30: mandatory contract clauses

Every ICT services contract must include at least: a full description of the services and the subcontracting conditions, the countries where the service is provided and data is processed, provisions on data availability, integrity and confidentiality, return of data if the provider fails, service levels, incident assistance, cooperation with authorities, termination rights and participation in the entity's training.

For critical or important functions, the contract must add quantified service levels, notification duties, tested continuity plans, participation in threat-led penetration testing (TLPT), unrestricted rights of access, inspection and audit and an exit strategy with a mandatory transition period. These clauses naturally fit into a security assurance plan annexed to the contract.

Implementing texts you should know

• Delegated Regulation (EU) 2024/1773 of 13 March 2024 specifies the content of the policy on ICT services supporting critical or important functions.
• Implementing Regulation (EU) 2024/2956 of 29 November 2024 sets the templates for the register of information.
• Delegated Regulation (EU) 2025/532 of 24 March 2025, published in the EU Official Journal on 2 July 2025, governs subcontracting of ICT services supporting critical or important functions.

The DORA register of information lists all contractual arrangements with ICT providers, at entity level and, where relevant, group level, distinguishing those that support critical or important functions. It describes providers, contracts, services, supported functions, processing locations and subcontracting chains. Its format, a set of linked tables, is laid down by Regulation 2024/2956.

It serves two purposes: managing your dependencies, and feeding supervision. National authorities sent the first registers to the European Supervisory Authorities (ESAs) by 30 April 2025, to identify critical providers. In France, filing takes place on the Banque de France's OneGate platform: for the 2026 campaign, the ACPR set a deadline of 31 March 2026, for data as at 31 December 2025.

The first campaign showed how hard the exercise is: according to the review presented by the ACPR in January 2026, 84% of entities had filed, but only 39% of filings could be processed at European level. Rejections mostly came from format issues (dates, file structure, encoding). The practical lesson: a register is kept up to date continuously, from reliable supplier data, not rushed before a deadline.

DORA creates an unprecedented framework: the ESAs (EBA, EIOPA, ESMA) directly oversee ICT providers deemed critical to the financial sector. On 18 November 2025 they published the first list, which includes 19 providers: large cloud providers, data centres, infrastructure and network providers, and financial-sector-specific technology. The list is updated every year.

A “Lead Overseer” can review their risk management, carry out inspections and issue recommendations. If a provider refuses to cooperate, it can impose periodic penalty payments of up to 1% of the provider's average daily worldwide turnover, for up to six months, and, as a last resort, lead national authorities to require financial entities to suspend or terminate the contract. For you as a customer, this changes nothing: your obligations under Articles 28 to 30 remain in full, including towards these large players.

Long before NIS 2 and DORA, Article 28 of the GDPR imposed a third-party risk approach for personal data. The controller may only use processors providing “sufficient guarantees”, and must sign a contract with each one that provides at least for:

• processing only on documented instructions, and confidentiality of authorised persons;
• the security measures of Article 32;
• prior authorisation of any sub-processing, with the same obligations for the second-tier processor;
• assistance to the controller with data subject rights, breaches and impact assessments;
• deletion or return of data at the end of the contract;
• making information available and allowing audits, including inspections.

The French data protection authority, the CNIL, details these points in its guide for processors. It also fines providers themselves: in April 2022, the software vendor Dedalus Biologie was fined €1.5 million after a leak affecting more than 500,000 people, in particular for breaching Articles 28, 29 and 32. To keep your record and processor contracts in order, see our GDPR compliance module.

The three texts overlap widely. The comparison below puts them side by side, requirement by requirement, with the reference of the relevant article.