Suppliers: questions and answers.
Supplier and third-party risk under ISO 27001, ISO 42001, NIS2, DORA and the GDPR.
What is third-party risk management?
Third-party risk management is identifying, assessing and controlling the risks that come from suppliers, such as cloud providers, software vendors and service providers. ISO 27001 covers it in the supplier controls of Annex A, and NIS2 and DORA make it an explicit obligation.
How do you assess a supplier’s security?
Classify suppliers by risk first, so the effort matches the impact. For important suppliers, check certificates and reports such as ISO 27001 or SOC 2, and read the scope: a certificate only covers what is in scope. Add contract clauses and repeat the assessment periodically.
What is a data processing agreement?
A data processing agreement is the contract that Article 28 of the GDPR requires when a processor handles personal data on your behalf. It sets out the subject, duration, purpose, types of data, security measures and the use of sub-processors.
How do NIS2 and DORA affect supplier management?
NIS2 requires entities to address supply chain security in their risk management measures. DORA requires financial entities to manage ICT third-party risk, keep a register of information on all contractual arrangements with ICT third-party service providers and include specific contract provisions.
What should we ask an AI supplier?
Ask about the intended use and limits of the AI system, the data it was trained and runs on, how changes to the model are communicated, how human oversight is supported and where data is processed. ISO 42001 asks you to manage the responsibilities you share with suppliers of AI systems.
Book a demo
Your question not answered?
In a demo we answer your questions in the context of your own frameworks and scope.
- Where you stand with ISO 27001 and ISO 42001.
- Which frameworks apply to you.
- How Basenorm keeps your management system current.
Hosted in the Netherlands. Your data stays in the EU.