Governance, Risk & Compliance
Third-Party & Supply-Chain Assurance
Due diligence, supplier classification, contractual requirements, control testing, supplier assessment and OSINT-based supplier and exposure analyses along the supply chain.
Overview
The supply chain has become a regulatory focal point. NIS2, DORA and the Cyber Resilience Act increase pressure on third-party and supplier relationships; NIST CSF 2.0 makes supply-chain risk management its own governance category. At the same time, the European Supervisory Authorities designated critical ICT third-party providers for the first time in 2025 - the need hits banks as well as their IT, cloud and infrastructure partners.
We create transparency over your third parties: a due diligence and supplier classification that ranks suppliers by criticality and risk. Only this classification allows attention and review effort to be directed where they are truly needed.
This is followed by robust contractual requirements and control testing: which security, evidence and reporting duties must contracts contain, and are the promised controls actually upheld? For the financial sector we integrate this with the DORA register of ICT third-party arrangements.
In addition we provide OSINT-based supplier and exposure analyses: publicly available information is evaluated in a structured way to detect supply-chain risks early - from exposed systems to reputational anomalies. This makes supply-chain risk steerable, instead of remaining a blind spot.
We deliver each of these services in three stages: as an assessment (baseline and gap analysis), as program build and implementation (structures, measures, evidence) and as ongoing steering - optionally as an interim mandate, fractional lead, evidence office or exercise and audit office. You decide how much responsibility to outsource and where to build your own capacity.
Standards & norms
- NIS2 (Lieferkettensicherheit)
- DORA (ICT-Drittparteienrisiko)
- NIST CSF 2.0 (Supply-Chain Risk)
Frequently asked questions
Why is a supplier questionnaire not enough?
Because self-assessments rarely reflect the actual risk. NIS2 and DORA require effective steering, not just declarations. We combine classification, contractual requirements and control testing with OSINT-based analyses.
What does OSINT-based supplier analysis mean?
The structured evaluation of publicly available information on a supplier - such as exposed systems or reputational anomalies. This reveals risks that do not appear in self-assessments. We use exclusively legal, public sources.
How does this relate to DORA?
DORA requires financial entities to actively manage ICT third-party risk including a maintained register. Our assurance service provides the classification, contractual requirements and evidence that make this register robust.