We map your suppliers and providers, assess their criticality, carry out due diligence, strengthen the clauses, monitor their security over time and prepare exit plans.
A large share of incidents now comes through a provider: a managed service provider, a software vendor, a cloud service. Outsourcing an activity does not outsource its risk.
So we treat each third party according to its criticality: a light review for most, in-depth due diligence, solid clauses, continuous monitoring and an exit strategy for those you really depend on.
Effort proportionate to each third party’s criticality, to focus the work where it reduces risk.
You getA register of third parties ranked by criticality
You getAn assessment per critical third party
You getTemplate clauses and amendments
You getContinuous monitoring and exit plans
DORA, NIS 2 and the GDPR converge: know your third parties, choose them on guarantees, contract and be able to exit.
Financial entities manage ICT third-party risk within their risk management framework, keep a register of information on all their ICT services contracts and only contract with providers that comply with appropriate information security standards.123
For services supporting critical or important functions, they put exit strategies in place.4
The directive asks Member States to require of entities supply chain security, taking into account their suppliers’ cybersecurity practices; the ReCyF (working version) sets them the objective of an up-to-date list of their providers and of processes, notably contractual, to ensure their services comply.567
The controller only uses processors providing sufficient guarantees; the CNIL likewise recommends using only such processors, and considering the whole subcontracting chain, not only direct processors.8910
The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.
You choose the level; the scope and deliverables are set by contract.
We keep the third-party register up to date and monitor critical third parties at agreed intervals.
DeliverablesWe carry out assessments, analyse the answers and recommend clauses and measures, which you decide on.
DeliverablesWe run the programme with your procurement, legal and business teams, without making the changes in your systems.
DeliverablesSecurity questionnaires proportionate to the third party’s criticality, ready to send.
Security, incident notification, audit, location, reversibility: clauses to adapt with your lawyers.
Register of third parties, assessments, contracts and gaps in one tool shared with your teams.
No. All are listed, but effort follows criticality: a light review for most, in-depth due diligence and continuous monitoring for those your activities or sensitive data depend on.
Document the risk, look for compensating measures on your side, and have the residual risk accepted by the right person. For a financial entity subject to DORA, the exit strategy then becomes all the more important.4
It is a regulated form of it, centred on ICT services contracts. For a financial entity, we keep both together so each piece of information is entered only once.2
No. We assess your suppliers remotely: questionnaires, evidence requested, non-intrusive technical observations. Where criticality justifies an in-depth audit and the contract allows it, we help you find the right auditor, whom you mandate, and fold its findings into the follow-up.
Describe your main providers and what they do for you. We come back to you with a scoping proposal.
Exact text, in its original language, from the frameworks extracted from the official text.
32022R2554-a28-p1Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles:32022R2554-a28-p3As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not. Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided. Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity. Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important.32022R2554-a28-p5Financial entities may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards. When those contractual arrangements concern critical or important functions, financial entities shall, prior to concluding the arrangements, take due consideration of the use, by ICT third- party service providers, of the most up-to-date and highest quality information security standards.32022R2554-a28-p8For ICT services supporting critical or important functions, financial entities shall put in place exit strategies. The exit strategies shall take into account risks that may emerge at the level of ICT third-party service providers, in particular a possible failure on their part, a deterioration of the quality of the ICT services provided, any business disruption due to inappropriate or failed provision of ICT services or any material risk arising in relation to the appropriate and continuous deployment of the respective ICT service, or the termination of contractual arrangements with ICT third-party service providers under any of the circumstances listed in paragraph 7. Financial entities shall ensure that they are able to exit contractual arrangements without:32022L2555-a21-p2-4supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;32022L2555-a21-p3Member States shall ensure that, when considering which measures referred to in paragraph 2, point (d), of this Article are appropriate, entities take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. Member States shall also ensure that, when considering which measures referred to in that point are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1).recyf:obj-3Les entités [importantes ou essentielles] réalisent et maintiennent à jour une liste des prestataires et fournisseurs informatiques intervenant dans la réalisation de leurs activités ou dans la fourniture de leurs services et avec lesquels il existe une relation de droit ou de fait ainsi que le périmètre et la nature de la prestation ou du service fourni.
Les entités [importantes ou essentielles] mettent en place des processus visant à s’assurer, notamment par la voie contractuelle de la conformité des prestations informatiques dont elles bénéficient aux obligations auxquelles l’entité est assujettie notamment en matière de gestion des risques qui menacent la sécurité de leurs réseaux et systèmes d’information et de notification des incidents importants.32016R0679-a28-p1Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.F14-PE-01Faire appel uniquement à des sous-traitants présentant des garanties suffisantes (notamment en termes de connaissances spécialisées, de fiabilité et de ressources).F14-MC-04Toute la chaine de sous-traitance (sous-traitants des sous-traitants) devrait être considérée et non seulement les sous-traitants directs.