Vetting

Supplier & Third-Party Vetting

Know what your suppliers actually do with your data — and prove it to your regulator.

The situation

NIS2 Article 21(2)(d) made supply-chain security a board-level legal duty, and DORA Chapter V made it an auditable one for financial entities. Most organisations answer with a questionnaire nobody reads.

We build a proportionate third-party assurance programme: tiering suppliers by the harm they could cause, setting the depth of vetting each tier earns, running the assessments, and turning the results into contract clauses, exit plans and a register that survives an inspection.

What the client receives

Schedule of deliverables

01Supplier criticality tiering model and risk appetite
02Vetting questionnaires and evidence requirements per tier
03On-site or remote supplier assessments and findings reports
04Security and resilience clauses for contracts and DPAs
05Concentration risk and exit strategy analysis
06Third-party register aligned to NIS2 / DORA reporting formats

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

NIS2 Art. 21(2)(d)
DORA Ch. V
ISO/IEC 27036
ISO/IEC 27001 A.5.19–A.5.23

VettingSystem & Architecture VettingIndependent technical assurance over solution architectures, cloud estates and code before you commit.Service detail VettingDigital Vetting & Cyber Due DiligenceCyber due diligence on the company, the counterparty or the asset you are about to acquire.Service detail

Discuss this engagement

Tell us about the supplier estate or the single supplier in question and we will set out the scope, the method and the reporting format.