Daniel Bermejo · Co-founder & Technology Lead, Trusty · Serial founder, ex PwC, IBM and Roche · Former Managing Director, Startup Invest
A cloud provider goes down.
A software supplier is breached.
A managed security provider is compromised.
A subcontractor introduces a vulnerability into your network.
Under both DORA and NIS2, saying “the problem happened at our supplier” does not necessarily remove your responsibility.
But the two EU cybersecurity regimes approach third-party risk differently.
in one platform
Keep your vendor evidence audit-ready. Track which suppliers support critical functions, collect due diligence and keep the proof regulators expect, all in one place.
DORA vs NIS2 at a glance
DORA | NIS2 | |
|---|---|---|
Full name | Digital Operational Resilience Act | NIS2 Directive |
Main focus | Digital operational resilience in the financial sector | Cybersecurity across essential and important sectors |
Third-party focus | ICT third-party service providers | Direct suppliers and service providers relevant to cybersecurity/supply-chain security |
Vendor register | Detailed register of ICT contractual arrangements | Not an equivalent universal DORA-style register requirement |
Criticality assessment | Major focus | Risk-based supply-chain assessment |
Contract requirements | Detailed requirements, especially for critical or important functions | Cybersecurity requirements should be addressed in supplier relationships as appropriate |
Subcontracting | Specifically relevant under DORA framework | Supply-chain risks can extend beyond direct suppliers |
Responsibility can be outsourced? | No | No simple transfer of cybersecurity responsibility |
Regulation or directive? | EU Regulation | Directive implemented through national law |
What does DORA require for third-party risk?
DORA applies to a wide range of financial entities and creates a dedicated framework for managing ICT third-party risk.
Its basic principle is simple:
Using an external ICT provider does not outsource your regulatory responsibility.
A financial entity remains responsible for complying with DORA even when an ICT service is provided by a third party.
That makes vendor oversight an ongoing governance issue rather than simply a procurement exercise.
Which third parties count under DORA?
DORA focuses on ICT third-party service providers.
Examples can include providers of:
- cloud infrastructure;
- software;
- data hosting;
- data centres;
- managed IT services;
- cybersecurity services;
- data processing;
- technology platforms;
- network infrastructure;
- certain outsourced ICT functions.
The key issue is whether the third party provides an ICT service used by the financial entity.
Not every supplier therefore needs identical DORA treatment.
Your office coffee supplier is not the same risk category as the cloud platform running a core banking process.
What about critical or important functions?
DORA places particular emphasis on ICT services supporting a critical or important function.
Before entering certain ICT arrangements, financial entities need to assess factors including whether the service supports a critical or important function and the risks arising from the arrangement.
That can affect:
- due diligence;
- contractual requirements;
- concentration-risk analysis;
- monitoring;
- audit/access rights;
- exit planning;
- subcontracting controls.
This means vendor classification matters.
A useful DORA inventory should not simply say:
Vendor: Cloud Company
It should capture something closer to:
Vendor → ICT service → business function → criticality → data → location → subcontractors → risk → contract → monitoring → exit strategy
Does DORA require a register of third-party providers?
DORA requires financial entities to maintain a register of information covering contractual arrangements for ICT services provided by ICT third-party service providers.
That is one of the clearest differences between DORA and a generic supplier-management program.
The organization needs to know not just who its suppliers are, but how ICT services map to contractual arrangements and business functions.
This register is also important for supervisory visibility into ICT dependencies.
Do you need to monitor every DORA ICT provider equally?
No.
DORA explicitly uses proportionality.
The level of oversight should consider factors including:
- the nature of the ICT dependency;
- scale and complexity;
- importance of the service;
- whether it supports a critical or important function;
- the potential impact of disruption;
- concentration risk;
- substitutability;
- subcontracting;
- geographic or operational dependencies.
That creates a tiered approach to vendor risk.
Identify all relevant ICT arrangements → classify them → apply stronger controls where the risk is greater.
ICT providers
Need to show proportionate oversight? Trusty tracks which suppliers support critical or important functions, collects due diligence and keeps the evidence regulators expect, all in one place.
What does NIS2 require for third parties?
NIS2 takes a broader cybersecurity and supply-chain approach.
Article 21 requires covered essential and important entities to implement appropriate and proportionate cybersecurity risk-management measures.
One specifically listed measure is:
supply-chain security, including security-related aspects concerning relationships with each entity’s direct suppliers or service providers.
That means supplier cybersecurity is expressly part of NIS2 compliance.
Which suppliers should you assess under NIS2?
NIS2 places particular emphasis on direct suppliers and service providers.
When deciding what measures are appropriate, organizations should consider:
- vulnerabilities specific to each direct supplier or service provider;
- the overall quality of their products;
- cybersecurity practices;
- secure development procedures;
- resilience of services or products;
- relevant supply-chain dependencies.
The analysis therefore goes beyond asking whether a vendor has a cybersecurity certificate.
You need to understand what risk the vendor introduces into your network and information systems.
What types of NIS2 suppliers create particular risk?
Depending on the organization, relevant third parties can include:
- cloud providers;
- data centres;
- software vendors;
- SaaS providers;
- managed service providers;
- managed security service providers;
- IT consultants;
- hosting providers;
- communications providers;
- critical hardware suppliers;
- data-processing providers.
NIS2 specifically highlights risks involving providers such as data storage and processing services, managed security service providers and software suppliers.
Does NIS2 only cover direct suppliers?
The statutory supply-chain security requirement specifically refers to security aspects of relationships with direct suppliers or service providers.
But that does not mean deeper supply-chain risks can always be ignored.
The NIS2 recitals expressly recognize that organizations may consider risks arising from other levels of suppliers and service providers.
That becomes particularly relevant where:
- a critical supplier relies heavily on one subcontractor;
- software incorporates vulnerable third-party components;
- there is a single point of failure;
- a provider has significant geographic concentration;
- a supplier depends on another critical infrastructure provider.
So the practical question is not simply:
“Is this our direct vendor?”
It is also:
“Could a deeper dependency materially compromise our cybersecurity?”
DORA vs NIS2: who should you monitor?
A useful distinction is:
Under DORA
Start by mapping your ICT third-party service providers.
Then identify which services support critical or important functions.
Those arrangements deserve particularly robust assessment, contractual controls and ongoing oversight.
Under NIS2
Start with direct suppliers and service providers that can affect the security of your network and information systems.
Then assess whether important indirect dependencies create additional material cyber risk.
Example: using Microsoft Azure
Suppose a financial business relies on a major cloud provider for infrastructure supporting a critical function.
Under DORA, that arrangement is clearly relevant to the organization’s ICT third-party risk framework.
The organization may need to consider:
- service criticality;
- contractual provisions;
- availability;
- data location;
- security;
- audit and access rights;
- subcontracting;
- concentration risk;
- exit options.
If that organization is also within a NIS2-covered context, the same supplier relationship could be relevant to supply-chain cybersecurity.
The underlying vendor is the same.
The legal reason for assessing it is not.
Example: payroll provider
Consider an external payroll SaaS provider.
Under DORA, the first question is whether the service falls within the relevant ICT third-party framework and what functions it supports.
Under NIS2, the business should consider whether compromise of the supplier could create a material cybersecurity risk.
The resulting risk level could be considerably lower than that of the organization’s core cloud infrastructure.
This is why applying the same questionnaire and review schedule to every vendor is rarely the best approach.
does not fit every vendor
Screen suppliers by risk, not by habit. Trusty screens ICT providers and critical suppliers for compliance risks, sends due diligence requests and monitors results in one platform. Or book a walkthrough.
What should you check before onboarding a third party?
For higher-risk ICT suppliers, useful due diligence can include:
Corporate identity
Confirm which legal entity you are actually contracting with.
Ownership
Understand relevant ownership and group relationships.
Sanctions exposure
Check whether the company or relevant controlling parties present sanctions concerns.
Adverse media
Look for credible reporting about:
- cyber incidents;
- regulatory action;
- security failures;
- fraud;
- misconduct;
- major outages;
- data breaches.
Cybersecurity controls
Assess relevant security practices and certifications.
Subcontractors
Determine whether critical functions depend on other providers.
Concentration risk
Ask what happens if several critical services rely on the same provider.
Geography
Understand where services and data are provided and where critical dependencies exist.
Business continuity
Assess how the provider responds to disruption.
Exit planning
Determine whether the service could realistically be moved to another provider.
Third-party risk is therefore not just an IT-security exercise.
It can require combining cybersecurity, corporate, compliance, operational and reputational information.
DORA is more prescriptive about ICT vendors
One of the most useful ways to understand the difference is that DORA builds an explicit regulatory architecture around ICT third-party relationships.
Financial entities must integrate third-party risk into their ICT risk-management framework and maintain structured information about ICT contractual arrangements.
NIS2 establishes a broader cybersecurity obligation and expressly includes supply-chain security within it.
So:
DORA goes deeper into ICT outsourcing and vendor governance.
NIS2 embeds suppliers within overall cybersecurity risk management.
What if both DORA and NIS2 apply?
For financial entities, DORA is particularly important because EU law treats it as the sector-specific cybersecurity framework for covered financial entities in areas where its provisions qualify as sector-specific rules.
That means organizations should not simply duplicate every control in two separate compliance programs.
Instead, they should determine:
- which entity is in scope;
- which regulatory requirement governs the specific issue;
- which suppliers and ICT services are involved;
- whether one control can generate evidence supporting multiple compliance obligations.
A unified supplier inventory can help considerably.
A practical vendor-monitoring model
Instead of maintaining one spreadsheet for DORA, another for NIS2 and another for procurement, build a shared third-party inventory.
For example:
Supplier
↓
Legal entity + ownership
↓
Service provided
↓
ICT / non-ICT
↓
Business function supported
↓
Criticality
↓
Cybersecurity risk
↓
Sanctions / reputational risk
↓
Subcontractors
↓
Contract controls
↓
Monitoring frequency
↓
Incidents / changes
This allows compliance teams to apply different regulatory rules to the same underlying supplier data.
risk monitoring
One view of every supplier. Screen ICT providers and critical suppliers for compliance risks, send due diligence requests and monitor results in one platform, instead of separate spreadsheets for DORA and NIS2.
Do you need continuous supplier monitoring?
Neither regime means every piece of vendor information must literally be checked every second.
But third-party risk management cannot sensibly stop at onboarding.
Risk changes.
A provider may:
- suffer a cyberattack;
- experience a major outage;
- change ownership;
- receive regulatory sanctions;
- appear in adverse media;
- change subcontractors;
- alter service locations;
- develop financial difficulties.
Higher-risk providers therefore justify ongoing monitoring proportionate to the importance and risk of the relationship.
Frequently asked questions
Yes. Covered financial entities must manage ICT third-party risk as part of their ICT risk-management framework. This includes ongoing oversight proportionate to the nature and importance of the ICT dependency.
Yes. NIS2 explicitly requires supply-chain security measures and requires entities to consider vulnerabilities and cybersecurity practices associated with direct suppliers and service providers.
DORA focuses on ICT third-party service providers used by covered financial entities. Requirements become particularly significant where an ICT service supports a critical or important function.
NIS2's supply-chain requirements focus particularly on direct suppliers and service providers relevant to the security of the organization's network and information systems.
The core requirement specifically addresses direct supplier/service-provider relationships, but NIS2 recognizes that organizations can also consider risks arising from deeper levels of the supply chain.
No. Both frameworks support a risk-based, proportionate approach. Suppliers supporting critical functions or creating greater cybersecurity dependency generally warrant stronger controls.
No. DORA explicitly states that financial entities remain responsible for regulatory compliance when using ICT third-party providers.
DORA functions as sector-specific EU cybersecurity legislation for covered financial entities in relevant areas. The interaction needs to be assessed requirement by requirement rather than assuming that every NIS2 provision simply disappears.
The bottom line
DORA and NIS2 reach the same fundamental conclusion:
Your cybersecurity risk does not end at your organizational boundary.
But they approach supplier risk differently.
DORA: identify and manage ICT third-party dependencies, with particularly strong controls around services supporting critical or important functions.
NIS2: protect the security of your supply chain, particularly your relationships with direct suppliers and service providers.
For companies subject to either framework, the first practical step is therefore the same:
Know who your third parties actually are, what they provide, what they depend on and how their risk changes over time.
A third-party screening and monitoring workflow can add another layer to that assessment by continuously checking suppliers for sanctions exposure, ownership risk and adverse-media developments alongside operational and cybersecurity controls.
External sources:
EUR-Lex, Digital Operational Resilience Act (DORA)
EUR-Lex, NIS2 Directive
Related reading: how financial entities must monitor ICT providers under DORA, how SMEs can meet NIS2 requirements with a simple vulnerability reporting process, and third-party screening for SMEs.
THIRD-PARTY RISK SCREENING
QuickScreen360: screen suppliers and partners for compliance risks. Send due diligence requests, assign training and monitor results in one platform.