01What is third-party compliance?+
Third-party compliance is the process of ensuring that vendors, suppliers, and partners who access your systems, data, or processes meet the same regulatory and security standards you are required to uphold. Regulations like DORA, NIS2, ISO 27001, and GDPR all impose specific obligations on how you manage, monitor, and contractually bind these external relationships.
02What is DORA and who does it apply to?+
DORA (Digital Operational Resilience Act, Regulation EU 2022/2554) has been in force since January 17, 2025. It applies to financial entities operating in the EU: banks, insurers, investment firms, payment institutions, crypto-asset service providers. Articles 28-44 govern ICT third-party risk management, requiring mandatory contractual provisions, concentration risk assessment, and exit strategies for each critical provider.
03What does NIS2 require for supply chain security?+
NIS2 Directive Article 21(2)(d) requires essential and important entities to implement supply chain security measures covering relationships with direct suppliers or service providers. Organizations must assess the overall security posture of their suppliers' products and practices and propagate security requirements through their supply chain. Non-compliance can result in administrative fines up to 10 million euros or 2% of global annual turnover for essential entities.
04What is the difference between GDPR Article 28 and DORA third-party requirements?+
GDPR Article 28 applies whenever a third party processes personal data on your behalf, requiring a Data Processing Agreement covering security measures, sub-processing rules, and audit rights. DORA Articles 28-44 apply specifically to ICT service providers for EU financial entities, adding mandatory contract clauses, exit strategies, concentration risk analysis, and regulatory oversight of Critical Third-Party Providers (CTPPs). Both obligations can apply simultaneously to the same vendor; for example, a cloud provider processing customer data for a bank.
05How does ISO 27001 address supplier risk?+
ISO/IEC 27001:2022 dedicates four Annex A controls to supplier relationships: 5.19 (information security policy for suppliers), 5.20 (addressing information security within supplier agreements), 5.21 (managing information security in the ICT supply chain), and 5.22 (monitoring, review, and change management of supplier services). These controls require organizations to identify, assess, and continuously monitor supplier-related risks as part of a certified ISMS.
06Do I need to comply with both NIS2 and DORA?+
Possibly yes. For financial entities, DORA operates as lex specialis, meaning it takes precedence over NIS2 for ICT risk management. However, NIS2 may still apply to your ICT providers that serve critical infrastructure sectors beyond finance. Your compliance program should map both regulations and identify where they overlap or diverge; for example, incident reporting timelines differ: DORA requires a 4-hour initial report, while NIS2 requires a 24-hour early warning.
07How does Supplier Shield help with DORA compliance?+
Supplier Shield (part of Acuna GRC) provides a TPRM module that maps directly to DORA Articles 28-44. It automates vendor tiering by ICT criticality, generates DORA-aligned contract requirement checklists, tracks mandatory evidence (SOC 2 reports, penetration test results, ISO certificates), monitors concentration risk across critical ICT providers, and produces audit-ready reports for regulators including the ECB, BaFin, FINMA, and ACPR.
08What is Swiss FADP and how does it differ from GDPR?+
The Swiss Federal Act on Data Protection (nDSG / FADP), in force since September 1, 2023, protects personal data of Swiss residents. Key differences from GDPR: it does not require a specific lawful basis (processing is permitted unless unlawful exceptions apply), its supervisory authority is the FDPIC, and it has slightly different breach notification thresholds. Organizations that are GDPR-compliant are typically close to FADP-compliant with minor adjustments, particularly around processor agreement language and the FDPIC notification threshold.
09What is a Critical Third-Party Provider (CTPP) under DORA?+
A Critical Third-Party Provider (CTPP) under DORA is an ICT service provider formally designated by the Joint Committee of the European Supervisory Authorities (ESAs) based on systemic importance to EU financial stability. CTPPs are subject to direct regulatory oversight, including on-site inspections by the lead overseer and binding recommendations. Financial entities using a CTPP have enhanced contractual and monitoring obligations and must develop robust exit strategies to reduce dependency.
10What evidence does an auditor expect for third-party compliance?+
Auditors and regulators typically expect: a vendor inventory (all third parties with access to systems or data), risk tier classification (criticality and data access level), signed contracts meeting framework-specific requirements (DPAs for GDPR/FADP; ICT contracts for DORA), evidence of vendor assessments (questionnaires, SOC 2 reports, ISO certificates), a findings log with remediation status and SLAs, concentration risk analysis (especially for DORA), and a record of ongoing monitoring including contract renewals and evidence expiry dates.
