Suppliers, service providers, software vendors: how to manage the risk of the extended enterprise and meet the requirements of NIS 2, DORA and ISO/IEC 27001.
Supply chain security means managing the risks introduced by your suppliers, service providers, software vendors and cloud services. Your attack surface does not stop at your own network: it includes every third party that accesses your systems or delivers a component you use. NIS 2, DORA and ISO/IEC 27001 now make this an explicit requirement.
The extended enterprise: a shared attack surface
A modern organization depends on dozens, or even hundreds, of third parties: managed services, hosting, SaaS vendors, integrators, maintenance subcontractors, and open source libraries built into its applications. Each of them can become an entry point. Attacks of this kind follow a few well-known patterns:
compromise of a service provider that has remote access to your systems;
a tampered software update at a vendor, which is then distributed to all of its customers;
a malicious or vulnerable open source component built into an application;
the unavailability of a critical supplier, which halts your operations even without any intrusion.
What the frameworks say
Three texts currently shape expectations:
NIS 2: Article 21 requires essential and important entities to take risk management measures that include supply chain security, in particular the relationships with their direct suppliers. Entities must take into account the vulnerabilities specific to each supplier, the quality of its products and its secure development practices.
DORA: applicable since January 17, 2025 to financial entities in the European Union, the regulation devotes an entire pillar to managing the risk associated with third-party ICT service providers: mandatory contractual clauses, a register of information on contracts, exit strategies, and a European oversight framework for critical ICT service providers.
ISO/IEC 27001:2022: Annex A groups the supplier controls from 5.19 to 5.23, namely the information security policy for supplier relationships, requirements in supplier agreements, the ICT supply chain, monitoring and change management of supplier services, and the security of cloud services.
On the methodology side, the NIST SP 800-161 Rev. 1 publication (updated in November 2024) sets out a complete approach to cybersecurity supply chain risk management.
Mapping and classifying third parties
You cannot protect what you do not know. The first step is an inventory of third parties, enriched with a few criteria:
type of access: network access, access to data, or simple delivery of goods;
business criticality: what happens if the service stops for a week?
sensitivity of the data entrusted to them;
cascading dependencies: your critical suppliers have their own subcontractors.
This classification makes it possible to scale the effort: an office supplies vendor does not call for the same due diligence as a managed service provider holding administrator accounts.
Governing the relationship at every stage
Managing third-party risk follows the contract lifecycle:
before signing: a security questionnaire tailored to the level of criticality, review of available certifications and audit reports, and analysis of the results;
in the contract: security requirements, an obligation to report incidents within a defined timeframe, the right to audit, data location, subcontracting conditions and reversibility;
during performance: periodic reviews, monitoring of incidents and changes, and control of remote access;
at the end of the contract: revocation of access, return or destruction of data, and execution of the exit plan.
Technical measures that limit the impact
Contracts are not enough; you also need to reduce what a compromised third party can reach:
remote access for service providers through a dedicated solution, with MFA, logging and, for privileged accounts, session recording;
the principle of least privilege and time-limited access;
network segmentation isolating equipment maintained by third parties;
a software bill of materials (SBOM) and monitoring of the vulnerabilities affecting the listed components;
verification of the integrity of updates before deployment whenever possible.
Skills and training
Supply chain security combines governance, regulatory compliance and technical controls. These learning paths will help you take charge of it:
Your suppliers are part of your security perimeter. Inventory them, classify them according to their criticality, govern each relationship through contracts and technically limit their access. This approach meets the expectations of NIS 2, DORA and ISO/IEC 27001 at the same time, and reduces a real risk to your business.