Supplier risk management: how to ensure GDPR, DORA, NIS 2 and ISO 27001 compliance?

The main steps for steering supplier risk management

Mapping suppliers and assessing risks

The first essential step in supplier risk management is to draw up an accurate map of your external partners. This map makes it possible to list all your suppliers, subcontractors and service providers, and to classify them according to their importance for your operations. The more critical a supplier is for your value chain, the more vital it is to assess and manage the risks associated with its performance. This classification helps you focus your efforts where the risks are highest.

In this process, several factors must be taken into account for a complete risk assessment:

• Financial stability: the supplier’s financial health is a key indicator. A partner in financial difficulty may be more likely to fail to meet its obligations, delay its deliveries or reduce the quality of its services. It is important to monitor indicators such as financial statements, debt histories, or dependence on a small number of customers.
• Cybersecurity: in a world where cyberattacks are more and more frequent, it is crucial to make sure that your suppliers meet robust cybersecurity standards. Compliance with standards such as ISO 27001 or NIS 2 is a good indicator of the maturity of their security systems. Furthermore, the protection of your suppliers’ information systems has a direct influence on the security of your own company.
• Regulatory compliance: it is imperative to check that the supplier complies with the laws in force in the areas relevant to your collaboration. For example, if your supplier processes personal data on your behalf, it must comply with GDPR. For critical sectors such as finance, meeting the requirements of the DORA regulation is also essential.
• Production capacity: a supplier must be able to meet your needs in terms of volume and quality, while respecting the agreed deadlines. Insufficient production capacity can cause delays that affect your entire supply chain and your final delivery times. It can also cause stock shortages that will lead to a loss of market share.
• Environmental impact and CSR: Corporate Social Responsibility (CSR) criteria are becoming more and more important. Customers, investors and even regulators now expect companies to adopt ethical and responsible practices throughout their supply chain. You should make sure that your suppliers meet environmental, ethical and social standards.

A successful supplier map lets you visualise your entire ecosystem and quickly identify your critical suppliers. Once this map has been drawn up, it becomes easier to prioritise actions and to focus efforts on managing the risks related to the most strategic partners.

Supplier security audits

Once the critical suppliers have been identified, it is necessary to carry out regular audits to guarantee that these third parties do meet the security and compliance requirements. These audits must be rigorous and cover several areas to provide a complete assessment of the supplier.

Here are the main aspects to audit:

• Cybersecurity processes: make sure that the supplier has put in place measures to protect its information systems. This includes data encryption, access management, and protocols for detecting and responding to security incidents.
• Regulatory compliance: suppliers must comply with the standards that are relevant in their sector. This can include compliance with GDPR, with the NIS 2 Directive for critical infrastructure, or with ISO 27001 for information security management. An audit makes it possible to verify that they do follow the required practices and that they are up to date with regulatory changes.
• Internal risk management policies: it is important to assess how the supplier manages its own risks. Does it have solid internal procedures to identify, monitor and mitigate risks? Does it have business continuity plans in the event of a crisis? These policies make it possible to assess the supplier’s resilience.
• Impact on the supply chain: an audit must also assess a supplier’s potential impact on your entire supply chain. If this supplier were to fail, what would the consequences be for your operations? A supplier further down the chain can also affect other suppliers, creating a domino effect.

Audits must be regular and adapted to changes in the risks and in the relationships with suppliers. An initial audit is not enough, because risks can change over time, new flaws can appear, and the supplier’s situation can change. It is therefore crucial to build audits into a strategy of continuous risk management.

Continuous monitoring and risk follow-up

Supplier risk management does not end once the audits have been carried out. It is vital to put in place continuous risk monitoring so as to react quickly to any change in your suppliers’ situation. With real-time risk management tools, it becomes possible to track how the performance and the risks associated with each supplier evolve.

Here are some of the actions to carry out as part of continuous monitoring:

• Tracking security incidents: cyber threats evolve quickly. Continuous monitoring makes it possible to detect any incident affecting a supplier and to act immediately to limit the impact on your organisation. For example, in the event of a cyberattack at a supplier, it is crucial to assess the risks for your own systems and to take preventive measures.
• Tracking operational performance: you must continuously monitor your suppliers’ performance, in particular in terms of the quality of deliveries, compliance with deadlines and contractual compliance. Key performance indicators (KPIs) can be used to measure these aspects and to anticipate delays or drops in quality.
• Continuous financial analysis: a supplier’s financial stability can fluctuate over time. Monitoring key financial indicators makes it possible to detect any sign of difficulty and to reassess the supplier’s level of risk accordingly. If its finances deteriorate, it may be necessary to look for alternatives.
• Automatic alerts and notifications: modern risk management tools can generate automatic alerts when there is a change in a supplier’s risk profile. These alerts make it possible to react quickly and to adjust prevention and protection measures.
• Updating risk assessments: over time, it is important to reassess the risks related to suppliers regularly. This makes it possible to take into account changes in the economic situation, new risks related to technological developments or regulatory changes.

Continuous monitoring, combined with proactive management, makes it possible not only to minimise risks, but also to strengthen the resilience of your supply chain in the face of uncertainty.

Understanding the main regulations: GDPR, DORA, NIS 2 and ISO 27001

GDPR: protecting personal data throughout the supply chain

GDPR (General Data Protection Regulation) is a European regulation that governs the protection of personal data. It imposes strict obligations on all companies that collect, process or store personal data, including in their relationships with third parties.

In the context of supplier risk management, GDPR requires companies to make sure that their suppliers also meet these obligations. A company can indeed be held liable for a data breach committed by one of its service providers. It is therefore imperative to:

• Check compliance: before working with a supplier that will have access to personal data, you must check that it complies with GDPR requirements. This includes measures such as access management, data encryption and the implementation of clear privacy policies.
• Put contractual clauses in place: all contracts with suppliers involving the processing of personal data must contain specific clauses on data protection. This makes it possible to ensure that the supplier takes the appropriate measures to protect the data and that it gives notice immediately in the event of a breach.
• Regular audits: to guarantee ongoing compliance, it is recommended to audit suppliers regularly on their data processing practices. Audit reports can serve as evidence in the event of an inspection by the data protection authorities.

The DORA regulation: strengthening the resilience of financial services

The DORA regulation (Digital Operational Resilience Act), adopted by the European Union and applicable since 17 January 2025, aims to guarantee that companies in the financial sector have systems capable of withstanding IT disruptions, including cyberattacks. It also requires companies to make sure that their service providers, in particular their IT suppliers, meet high standards of security and resilience.

Companies in the financial sector must therefore:

• Audit their IT suppliers: it is essential to make sure that IT service providers have put in place sufficient security measures to protect data and ensure the continuity of services. This includes implementing disaster recovery and business continuity plans.
• Monitor incidents: companies must have mechanisms to monitor the incidents affecting their critical suppliers. This makes it possible to act quickly in the event of an interruption or an attack, thereby minimising the repercussions for the company and its customers.
• Put contingency plans in place: DORA requires companies and their IT suppliers to have clear contingency plans in place to ensure the continuity of services in the event of a crisis. These plans must be tested regularly.

The NIS 2 Directive: a cybersecurity framework for critical infrastructure

The NIS 2 Directive (Network and Information Systems) is a European framework that strengthens cybersecurity requirements for essential entities and important entities, classified according to their sector of activity and their size. This legislation requires the entities concerned to secure their information systems and to guarantee that their suppliers also adopt robust cybersecurity measures.

Companies covered by the NIS 2 Directive must:

• Identify critical suppliers: these include IT service providers, subcontractors in critical infrastructure sectors, and energy and telecommunications suppliers. These partners must be subject to enhanced risk assessments.
• Audit supplier security: it is imperative to make sure that suppliers adopt security standards that comply with the NIS 2 Directive. This includes protection against cyberattacks, but also the ability to react quickly in the event of an incident.
• Incident response plan: companies must draw up incident response plans, in collaboration with their critical suppliers, to minimise the impact of a cyberattack or an outage.

ISO 27001: a global framework for supplier risk management

ISO 27001 is an international standard that sets out the requirements for an information security management system (ISMS). This standard offers a comprehensive framework for identifying and treating information security risks, including those that come from suppliers.

Bringing yourself into compliance with ISO 27001 involves several actions:

• Supplier risk assessment: the company must assess the risks related to the access to and processing of information by suppliers. This assessment is an integral part of the organisation’s risk management strategy.
• Implementing security controls: it is necessary to impose clear and measurable security controls on suppliers, such as access management, system monitoring, and protection against internal and external threats.
• Supplier audits and certification: to guarantee compliance with security standards, it can be useful to choose suppliers that are already ISO 27001 certified or to set up regular audits to verify their compliance with this standard.

Tools and solutions to make supplier risk management easier

SaaS solutions: centralised and collaborative management

SaaS platforms specialising in supplier risk management offer considerable advantages. They make it possible to centralise all the information concerning your third parties, to track risk assessments, to manage audits and to facilitate collaboration between the internal teams.

These solutions often include:

• Dashboards to track the performance indicators of suppliers
• Automated reporting tools to facilitate decision-making
• Modules for the real-time tracking of incidents or of non-compliance

Automation and artificial intelligence for risk assessment

The use of automation and artificial intelligence (AI) makes it possible to make risk management more effective. Thanks to these technologies, companies can identify potential risks more quickly, predict problems before they arise, and adjust their strategy accordingly.

AI can, for example, analyse supplier contracts to check their compliance with the standards in force, or assess their financial stability on the basis of public data.

How to put an effective supplier risk management strategy in place?

Integrating supplier risk management into your overall strategy

Supplier risk management must be an essential component of the company’s overall strategy. All too often, companies regard supplier risk management as a secondary task, when it plays a crucial role in protecting the organisation’s assets, ensuring the continuity of operations and complying with regulations.

To integrate supplier risk management effectively into your overall strategy, here are a few steps to follow:

• Alignment with the company’s objectives: your supplier risk management strategy must be aligned with the strategic objectives of your organisation. For example, if your company focuses on innovation and speed to market, it is crucial to select suppliers that support these priorities while minimising potential risks.
• Collaboration between departments: supplier risk management does not only concern the purchasing department or the security department. It is important to collaborate with the different internal teams (IT, legal, compliance, production, etc.) to make sure that every aspect of the risk is taken into account. Effective collaboration will give a broader view of the potential risks related to suppliers.
• Documented policies and procedures: developing clear and well-documented supplier risk management policies is essential to ensure consistent implementation throughout the organisation. This includes standardised procedures for selecting suppliers, for audits and for incident management. These policies must be regularly reviewed and adapted to regulatory or commercial changes.
• Performance tracking: putting in place key performance indicators (KPIs) to track and evaluate the performance of your suppliers over time is crucial. These KPIs must include financial, operational and compliance aspects. Continuous performance tracking makes it possible to quickly identify at-risk suppliers and to adjust your plans accordingly.

Training suppliers and raising their awareness of security and compliance

Suppliers play a central role in the supply chain and, consequently, in risk management. However, not all suppliers are necessarily aware of the risks to which they expose your company. It is therefore essential to train them and raise their awareness of good practices in terms of security and compliance.

Here is how to train your suppliers to reduce risks:

• Organise regular training: offer your suppliers specific training on security issues, data protection (GDPR) and compliance standards (ISO 27001, NIS 2, etc.). This training can cover topics such as access management, protection against cyberattacks or operational resilience. E-learning modules can also be set up to provide ongoing training.
• Raise awareness of the importance of compliance: many suppliers underestimate the consequences of non-compliance, whether it is a matter of GDPR breaches or of failing to meet security standards. Communicate clearly about the regulatory requirements and the expectations you have of them, making it clear that their performance and their compliance can directly affect your business relationship.
• Encourage suppliers to obtain certifications: it can be useful to encourage your suppliers to obtain certifications in security and risk management, such as ISO 27001 or SOC 2. These certifications demonstrate a commitment to security and give your company reassurance about their ability to meet the standards.
• Establish open collaboration: encouraging a transparent relationship with your suppliers is essential to ensure effective risk management. Your suppliers must feel comfortable reporting any problem or security incident without fear of having their contract terminated. This allows problems to be resolved more quickly, before they seriously affect your operations.

Supplier risk management is a priority for any company concerned with protecting its supply chain and ensuring compliance with regulations. By adopting a proactive approach, using the right tools and building this approach into your overall strategy, you will be able to anticipate threats and strengthen the resilience of your organisation.

In Make IT Safe, the third-party assessment module brings together the map of your suppliers, the assessment campaigns sent to them, the supporting evidence and the action plans that result from them, linked to the frameworks you follow. To see a supplier assessment campaign in the tool, request a demonstration.