Third party risk has moved from a background concern to a front page issue for European organizations. DORA has been enforceable for financial entities since January 2025, and NIS2 is now being transposed into national law across the European Union, including in France through the Loi Résilience. For CISOs, compliance directors and procurement leaders, this means one thing above all: the way a company manages the risk introduced by its vendors and service providers is no longer a matter of internal preference. It is a documented, auditable obligation.

This guide brings together the essentials of Third Party Risk Management, known as TPRM, and explains how NIS2 and DORA shape what organizations are now expected to do.

What TPRM actually means

TPRM refers to the structured process of identifying, assessing and monitoring the risks that vendors, suppliers and service providers introduce into an organization. It covers cyber security posture, but also operational resilience, data protection and contractual accountability. A mature TPRM program does three things well. It maintains a clear inventory of every third party and the systems they touch. It assesses each of them against a consistent set of criteria. And it tracks issues through to resolution, with a named owner and a deadline.

Where NIS2 fits

NIS2 broadens the scope of European cyber security regulation to eighteen sectors, well beyond the operators originally covered by the first NIS directive. Article 21 requires essential and important entities to manage supply chain security explicitly, meaning organizations can no longer treat vendor oversight as informal or occasional. In France, the Loi Résilience transposes NIS2 alongside DORA and the Critical Entities Resilience directive in a single legislative vehicle, which is a distinctive national approach worth understanding for any company operating in the French market.

Where DORA fits

DORA applies to twenty categories of regulated financial entity and takes a considerably more prescriptive approach to third party risk than NIS2. It requires a complete Register of Information covering every ICT provider supporting critical or important functions, including subcontractors, data locations and exit strategies. It also requires ongoing testing of operational resilience and clear criteria for identifying which providers count as critical.

Why continuous oversight matters now

Both frameworks push organizations away from a once a year questionnaire and toward continuous monitoring. Regulators are already flagging incomplete registers and outdated assessments as priority enforcement areas in 2026. An assessment completed twelve months ago tells a board very little about a provider's current exposure.

This is exactly where many organizations get stuck. Building and maintaining a live register of providers, running assessments consistently, and producing evidence on demand is difficult to do manually once a vendor portfolio grows past a handful of names.

If your team is trying to bring structure to this process without adding headcount, it may be worth seeing how a dedicated platform handles it. Booking a short demo with Cynapze is a simple way to see what a continuously updated TPRM program looks like in practice.

Getting started

Organizations beginning this work should start with an honest inventory of every third party in use, however minor it may seem. From there, tiering providers by criticality allows a team to focus attention where it matters most, rather than treating every vendor equally. Finally, building a habit of documentation, who was assessed, when, and what was found, turns compliance into a byproduct of good practice rather than a separate scramble before an audit.

Conclusion

TPRM, NIS2 and DORA are converging around the same expectation: organizations must know their third parties, assess them consistently, and be able to prove it. That is a significant shift from how many companies have historically operated, but it is also an opportunity to build a program that protects the business well beyond what any single regulation requires. Teams that start now, with clear ownership and the right tools, will be in a far stronger position when the next audit or incident arrives.

To see how Cynapze can support your third party risk program from day one, book a demo with our team.