Your next breach may arrive through a supplier

Assessed once, then invisible

The pattern is familiar because it is everywhere. Procurement runs a security questionnaire before signature, security gives an opinion, the contract is signed, and the vendor disappears from view. Two years later the same vendor holds more data, more access and more of your process than anyone decided on purpose. ENISA measured supply-chain attacks growing 38% in its 2024 Threat Landscape; the attacker has noticed what the register has not.

What the regulators expect

The texts have caught up with the pattern. NIS2 Article 21(2)(d) lists supply-chain security among the mandatory risk-management measures, explicitly including the security aspects of the relationships between an entity and its direct suppliers. DORA Article 28 requires financial entities to keep a register of information on all their ICT third-party arrangements, current and producible on request, and its oversight logic assumes continuous assessment cycles rather than a one-off questionnaire. The common point is simple: the risk you inherit from suppliers is your risk, and someone in your organisation signs it off.

A lifecycle, not a questionnaire

Meeting that expectation takes a workflow that continues after signature:

• 01 · Onboarding and tiering. Profile, classification and inherent criticality, so the depth of assessment matches what the vendor could break.
• 02 · Automated assessment. Questionnaires tailored to the tier, sent through a supplier portal, with reminders and evidence requests handled by the workflow rather than by mailbox.
• 03 · Scoring and gap analysis. Dependency, access, cyber maturity and trust scored into a risk zone, so the discussion moves from adjectives to positions.
• 04 · Decision and continuous oversight. Approve, remediate or reassess as the risk evolves, on a schedule the platform enforces.

The zones make the state legible at a glance: trust means assessed and within appetite with periodic review, watch means enhanced due diligence and follow-up, danger means immediate remediation or escalation.

How SynapseRM / TPRM does it

• A dedicated supplier portal. Vendors answer questionnaires and upload evidence through their own secure access, with MFA on every account, supplier accounts included.
• Scoring you can defend. Each vendor's dependency, access, cyber maturity and trust are scored into a radar and a risk zone, with the validation status of procurement, DPO and security visible on the record.
• Attack scenarios. Graphical scenarios show how a compromise at a given supplier reaches your critical assets, which turns tiering debates into something you can point at.
• An architecture that assumes the worst. The portal runs as an independent stack. SynapseRM initiates every exchange and the portal never calls in, so a compromise of the supplier-facing side does not open a path into the risk platform.
• The DORA register, ready. The third-party register stays current, tiered and exportable for the authority, as Article 28 requires.

Onboarding is where supplier risk management starts. Regulators, and attackers, are interested in everything that happens after.