Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Did you know that 62% of data breaches occur through external vendors?
In addition, more than 80% of companies share sensitive data with third parties, and 98% of organizations are connected to at least one vendor that has suffered a security breach in the past two years.
These figures, drawn from Verizon’s Data Breach Investigations Report, show that the real challenge in compliance management is now third-party management: vendors,
business partners, and external collaborators (such as cloud computing platforms, data centers, or payroll processors) can be both strategic allies and sources of risk.
This relationship means that companies must extend their compliance and security efforts to these third parties to ensure a safe and trustworthy business environment.
What is Compliance 2.0?
“Compliance 2.0” goes beyond internal regulations and requirements: it represents a strategic approach in which companies seek not only to comply with laws, but to create a comprehensive system of protection and ethics that covers both their employees and all external stakeholders.
This means that third parties must be monitored and assessed using criteria similar to those applied to internal employees, as they may have access to systems, confidential data, and resources that, if compromised, would put the company’s security and reputation at risk.
Types of risks and the importance of third-party security.
One of the main reasons Compliance 2.0 should start with third parties is that they are exposed to threats similar to those faced by any internal department.
A vendor with weak digital security, for example, could be the entry point for attacks or data leaks. In addition, an ethical or regulatory failure by a third party could compromise the reputation and operations of the primary company.
And what are the most common risks that arise when partnering with external vendors?
- Cybersecurity risks.
- Compliance risks.
- Financial risks.
- Reputational risks.
- Operational risks.
- Strategic risks.
In this context, managing third parties means managing the extension of security and business ethics.
Steps to implement effective Compliance 2.0
So, how can Compliance 2.0 be effectively executed within a company?
- Identification and assessment of critical third parties
To implement a robust Compliance 2.0 program, the first step
is to identify those third parties that represent higher risk. These
may be key service providers, such as IT companies or
consultancies, that handle sensitive information.
It is essential that each company assesses its third parties in terms of
security, ethics, and their ability to comply with the regulations required in the
sector. - Continuous monitoring and risk assessment tools
Monitoring and assessing third parties should not be one-off processes,
but continuous. As threats evolve, so do
the risks associated with each vendor.
Using compliance software tools, such as those offered by
Trusty, makes it possible to continuously track the risks associated with
each third party and quickly detect any irregular behavior or
non-compliance. - Culture, transparency, and communication across the entire supply chain
Building an effective compliance culture must also extend to third parties. This involves conveying to vendors and partners the importance of adhering to the same regulations and ethical practices.
Companies can set specific requirements in contracts and train their partners in compliance, security, and data management best practices. By fostering a culture of compliance across the entire supply chain, it ensures that third parties understand the company’s standards and are better prepared to protect its interests.
Therefore, being transparent with third parties, communicating with them regularly, and conducting periodic assessments help prevent issues and promote mutual trust, avoiding security breaches.
Benefits of third-party-focused Compliance 2.0
Adopting a third-party-focused compliance approach not only mitigates risks, but also offers competitive advantages. Companies with robust compliance programs can attract partners and customers who value security and ethical compliance. In addition, a well-implemented system improves operational efficiency, minimizes the risk of penalties, and strengthens corporate reputation.
Ultimately, Compliance 2.0 recognizes that companies are no longer isolated, but operate in an interconnected environment where third parties play a crucial role. Managing third-party risks is essential to protect a company’s assets, reputation, and regulatory compliance.
Trusty’s solutions can facilitate the process of creating a secure, compliant ecosystem. The whistleblowing systems offered by Trusty enable companies to implement clear ethics and compliance policies, while also fostering a secure and anonymous communication channel.
Related reading: Supply Chain Compliance for SMEs: What Changes in 2026 and How SMEs Can Meet NIS2 Requirements with a Simple Vulnerability Reporting Process.
Frequently asked questions
A strategic approach that goes beyond internal rules. The company builds a comprehensive system of protection and ethics that covers its employees and all external stakeholders, and it monitors and assesses third parties with criteria similar to those applied to internal employees.
Because that is where much of the risk sits. Verizon's Data Breach Investigations Report puts 62 percent of data breaches at external vendors, more than 80 percent of companies share sensitive data with third parties, and 98 percent of organizations are connected to at least one vendor breached in the past two years.
Cybersecurity, compliance, financial, reputational, operational and strategic risks. A vendor with weak digital security can be the entry point for attacks or data leaks, and an ethical or regulatory failure by a third party can compromise the reputation and operations of the primary company.
Identify and assess the third parties that represent higher risk, monitor them continuously with risk assessment tools rather than one-off checks, and extend the compliance culture to the whole supply chain through contract requirements, training and regular, transparent communication.
THIRD-PARTY RISK SCREENING
QuickScreen360: screen suppliers and partners for compliance risks. Send due diligence requests, assign training and monitor results in one platform.