As regulators tighten expectations and cyber attacks increasingly exploit supply chains, organisations must shift from periodic vendor assessments to continuous third-party cyber resilience.

For years, third-party cyber risk management focused primarily on vendor due diligence and annual security assessments. The objective was simple: determine whether a supplier met an acceptable level of security at a specific point in time.

That approach no longer reflects today’s threat landscape.

Cyber resilience is no longer about protecting only your own environment; it’s about maintaining operations when a third-party’s environment fails. Whether through software vulnerabilities, or failures in managed service providers, cloud platforms, or outsourced business services, third-party technology now features in a significant proportion of cyber incidents and investigations.

As a result, organisations are being challenged to move beyond traditional vendor assessments and adopt a resilience-focused approach to managing supply chain risk.

The Regulatory Shift

With regulators across the whole of Europe recognising the often business-critical risk posed by third parties, several major frameworks now place explicit responsibility on organisations to understand, monitor and actively manage their supply chain exposure:

• DORA (Digital Operational Resilience Act) in the EU introduces strict requirements for financial services organisations and their IT service providers.

• NIS2 expands cybersecurity obligations across a much broader range of critical sectors across Europe.

The common message is clear: organisations are expected to maintain continuous oversight of third-party cyber risk, not simply conduct a compliance exercise once a year.

DORA Raises the Bar

Among these regulations, DORA is particularly notable for its prescriptive approach to IT third-party risk management. The act requires financial institutions to implement controls that go far beyond traditional supplier assessments, including:

• Robust contractual requirements for IT providers

• Assessment and management of concentration risk

• Operational resilience and resilience testing programmes

• Oversight of critical IT providers

• Comprehensive IT vendor inventories and dependency mapping

These audits represent a fundamental shift from measuring supplier security posture to understanding how supplier failure could impact business operations.

With DORA fully applicable since early 2025, organisations and their IT providers are expected to demonstrate a mature and embedded approach to compliance. Audit activity is therefore shifting towards assessing the effectiveness and sustainability of controls, rather than focusing solely on implementation progress or the existence of compliance plans.

The Hidden Barrier of Annual Assessments

One of the biggest challenges with traditional third-party risk management is timing.

Annual assessments provide only a snapshot of risk at a single point in time. Supplier environments are constantly changing through infrastructure updates, emerging threats, active attacks, personnel changes, mergers and acquisitions, and other operational developments.

As a result, many organisations operate with an inaccurate understanding of their true exposure for much of the year.

Annual assessments tell you what was true at the time of the review. The reality, though, is that risk often emerges between review cycles. By the time an annual assessment identifies an issue with a supplier, the organisation may already be dealing with the consequences.

This highlights why continuous monitoring and operational preparedness have become essential components of modern third-party cyber risk management.

Cyber teams should work with third-party providers to proactively map their ecosystems, identify the gaps that need to be addressed, and reduce the risk of cyber incidents. Continuous monitoring and structured oversight mechanisms can help to detect issues early, before they escalate into supply chain-wide disruptions.

When a Supplier Incident Occurs: What Actually Matters

An effective third-party risk programme is not measured by how many assessments are completed. It is measured by the quality of supply chain intelligence and an organisation’s ability to respond effectively when a critical supplier experiences an incident.

Leading organisations are increasingly adopting a structured response model:

1. Detect

Identify potential supplier incidents through multiple channels, including continuous monitoring tools, threat intelligence feeds, open-source intelligence, and direct supplier communications.

The objective is to achieve early awareness before business disruption occurs.

2. Assess

Determine the business impact rapidly by asking the following questions:

• Which supplier is affected, and which services depend on them?

• Which business processes could be disrupted by this incident?

• How does the incident affect minimum viable business operations?

Understanding service dependencies is critical to effective and timely decision-making.

4. Decide

Make informed decisions using the best information available at the time. Actions may include escalating to crisis management teams, communicating with customers, updating internal stakeholders and making regulatory notifications. Modern regulations increasingly expect timely reporting, even when all facts are not yet available.

5. Recover

Focus on maintaining and restoring critical business services. This might involve:

• Switching to alternate providers

• Activating failover capabilities

• Implementing manual workarounds

• Executing business continuity plans

The goal is not to simply recover IT systems, but to protect critical business outcomes throughout the recovery process.

The Future of Third-Party Cyber Risk Management 

The conversation has evolved from vendor assurance to operational resilience.

Organisations can no longer assume that supplier failures are confined to a single company’s operations. Regulatory expectations, interconnected technology ecosystems and increasingly sophisticated cyber threats now require a continuous understanding of third-party risk and a clear plan for responding when disruptions occur.

Whilst supply chain ecosystems can be vast, organisations are increasingly dependent on a relatively small number of critical providers. This concentration risk is where many CISOs and cybersecurity teams continue to underestimate their exposure.

At the same time, boards and senior management can no longer ask “Are my vendors secure?” They must now ask “What happens to our business if one critical provider fails tomorrow?” Many enterprises can identify their highest revenue-generating customers faster than they can identify the five third-party vendors whose failure would bring operations to a standstill.

This is the new benchmark for effective third-party cyber risk management. Organisations that adopt this mindset will be better positioned to build cyber resilience and recover quickly if the worst happens.