Supply Chain Risk Assessment for Outsourcing Arrangements

An IT supply chain assessment is the systematic analysis and risk evaluation of all external IT service providers, software vendors and cloud providers an organisation relies on. It matters because over

80 percent of cyberattacks originate from third-party vulnerabilities. Regulatory frameworks including NIS-2 (Article 21), DORA (Chapter V) and ISO 27001 (Annex A.15) require organisations to continuously monitor and document the security posture of their IT suppliers.

Common methods include security questionnaires (SIG, CAIQ), automated security ratings (e.g. Bitsight, SecurityScorecard), ISO 27001 certification reviews, penetration testing and on-site audits. Best practice is a risk-based approach: critical suppliers with access to sensitive data receive comprehensive assessments, while non-critical suppliers are evaluated through self-assessments.

NIS-2 (Article 21, paragraph 2d) requires affected organisations to implement security measures for the supply chain, including security aspects in the relationships with suppliers and service providers. Specifically, organisations must assess the cybersecurity practices of their suppliers, establish contractual security requirements and monitor compliance. The EU ICT Supply Chain Security Toolbox provides a coordinated framework for implementation.

DORA (Digital Operational Resilience Act) applies specifically to the financial sector with stricter requirements than NIS-2: financial entities must maintain a register of all ICT third-party providers, comply with minimum contractual requirements (Articles 28‑30), and critical ICT third-party providers are directly supervised by European Supervisory Authorities. NIS-2 is the general framework, while DORA is the sector-specific regulation for financial services.

A vendor scoring system evaluates IT service providers against weighted criteria across categories such as information security (ISO 27001 certification, technical controls), data protection (GDPR compliance), availability (SLAs, disaster recovery), financial stability and regulatory compliance. Suppliers are classified into criticality tiers (critical, important, standard) that determine assessment depth and review frequency.

Typical IT supply chain risks include supply chain attacks (such as SolarWinds and MOVEit), compromised software updates, insecure APIs, missing security patches at subcontractors, data exfiltration through third parties and dependency on single cloud providers. Tier-2 suppliers with indirect system access are particularly critical — only

42 percent of organisations have visibility at this level.

ADVISORI guides you through the entire vendor risk assessment process: building a supplier inventory with criticality classification, developing tailored evaluation criteria based on ISO 27001 and ISO 27036, conducting supplier audits, implementing a continuous monitoring system and ensuring compliance with NIS-2 and DORA. From initial analysis through to ongoing third-party risk management.