GDPR, NIS 2, and DORA converge on one problem: Third-party risk

kAm#68F=2E@CD ?@ =@?86C 2D< H96E96C J@F >2?286 G6?5@C C:D<—E96J 2DDF>6 J@F 5@] p?5 :7 J@F 5@?’E[ J@F A2J 7@C :E]k^Am

kAm%9C66 :?56A6?56?E t& C68F=2E:@?D—E96 k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^4@==64E:@?^85AC^H92E\:D\85ACQmvs!#k^2m[ k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^C6D@FC46D^?:D\a\5:C64E:G6\C6BF:C6>6?EDQm}x$ a 5:C64E:G6k^2m[ 2?5 k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^C6D@FC46D^5:8:E2=\@A6C2E:@?D\C6D:=:6?46\24EQms:8:E2= ~A6C2E:@?D #6D:=:6?46 p4E Ws~#pXk^2m—DEC6DD E92E :E’D J@FC C6DA@?D:3:=:EJ E@ >2?286 E9:C5\A2CEJ C:D<] %96D6 C68F=2E:@?D @776C D64FC:EJ 7C2>6H@C<D E92E DFAA@CE 5:776C6?E :?5FDEC:6D 2?5 C:D< AC@7:=6D[ 3FE E96J 2== =625 H:E9 DEC:4E 7:?6D 2?5 AC6DDFC6 E@ 6?7@C46 E9:C5\A2CEJ C:D< >2?286>6?E]k^Am

kAm&?56C E96 vs!#[ 82AD :? 4@C6 D64FC:EJ 2?5 @A6C2E:@?2= 4@?EC@=D k2 9C67lQ9EEADi^^DFC7D92C<]4@>^C6D62C49^DEF5J^85AC\7:?6D\a_adQm5C@G6 adT @7 E96 7:?6D :? a_adk^2m[ FA c_T J62C @G6C J62C] s~#p 6>A92D:K6D E9:C5\A2CEJ @G6CD:89E[ E@@[ H:E9 k2 9C67lQ9EEADi^^HHH]G662>]4@>^4@>A2?J^AC6DD\C6=62D6^he\A6C46?E\@7\6>62\7:?2?4:2=\D6CG:46D\@C82?:K2E:@?D\36=:6G6\E96J\?665\E@\:>AC@G6\E96:C\C6D:=:6?46\E@\>66E\5@C2\C6BF:C6>6?ED]9E>=QmbcT @7 7:?2?4:2= 7:C>Dk^2m 42==:?8 :ED C6BF:C6>6?ED E96 92C56DE E@ >66E] }x$ a 92D 2=D@ 6IA=:4:E=J k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^C6D@FC46D^?:D\a\492?86DQm6IA2?565 :ED C6BF:C6>6?EDk^2m E@ :?EC@5F46 >2?52E@CJ 4J36CD64FC:EJ @3=:82E:@?D 24C@DD E96 DFAA=J 492:?]k^Am

kAm(96? E9C66 D6A2C2E6 C68F=2E:@?D 2=:8? @? 2 D92C65 6IA64E2E:@?[ :E D:8?2=D 2 DECF4EFC2= 3FD:?6DD C:D< 2?5 >2<6D G6?5@C >2?286>6?E 2? “2=H2JD @?” 24E:G:EJ] %9:D :D C67=64E65 :? k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^AC@5F4ED^E9:C5\A2CEJ\C:D<\>2?286>6?EQm'2?E2k^2m’D k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^DE2E6\@7\ECFDE^8=@32=Qma_ad $E2E6 @7 %CFDE #6A@CEk^2m[ H:E9 >@C6 E92? EH@\E9:C5D @7 @C82?:K2E:@?D DA6?5:?8 D:8?:7:42?E E:>6 @? k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^4@==64E:@?^EAC>^G6?5@C\D64FC:EJ\C6G:6HDQmD64FC:EJ C6G:6HDk^2m 2?5 H@CCJ:?8 23@FE G6?5@C 3C62496D]k^Am

k9bm%9:C5\A2CEJ C:D< :D >@C6 C68F=2E65 ?@Hk^9bm

kAmp3@FE 7:G6 J62CD 28@[ k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^4@==64E:@?^EAC>^E9:C5\A2CEJ\C:D<\>2?286>6?EQmE9:C5\A2CEJ C:D< >2?286>6?E W%!#|Xk^2m H2D >@DE=J EC62E65 2D 2 36DE AC24E:46[ 3FE C6A62E65 =2C86\D42=6 G6?5@C D64FC:EJ :?4:56?ED 92G6 D:?46 EFC?65 :E :?E@ 2? 6?7@C465 @3=:82E:@?]k^Am

kAmx? a_ab[ k2 9C67lQ9EEADi^^HHH]?4D4]8@G]F<^:?7@C>2E:@?^>@G6:E\GF=?6C23:=:EJQm|~'t:Ek^2m 6IA6C:6?465 2? 6IA=@:E65[ F?56E64E65 K6C@\52J GF=?6C23:=:EJ[ C6DF=E:?8 :? 3C62496D 27764E:?8 k2 9C67lQ9EEADi^^4@>>F?:EJ]:3>]4@>^4@>>F?:EJ^FD6C^3=@8D^52G:5\962E9^a_ad^_b^`f^D64FC:EJ\3C62496D\:?\4=6@\8@2?JH96C6\2?5\>@G6:E\a_Qm>@C6 E92? a[f__ @C82?:K2E:@?Dk^2m] q642FD6 E96 D@7EH2C6 H2D FD65 :? H@C<7=@HD :?G@=G:?8 D6?D:E:G6 52E2[ E96 :>A24E 5:5?’E DE@A H:E9 E96 G6?5@Ci xE 4C62E65 5@H?DEC62> =:23:=:EJ 7@C >2?J @C82?:K2E:@?D[ EC:886C:?8 C68F=2E@CJ D4CFE:?J 2?5 @G6C k2 9C67lQ9EEADi^^@CI]@C8^C6D@FC46^>@G6:E\EC2?D76C\52E2\3C62496D\@CI\?6HD\566A\5:G6QmS`_ 3:==:@? :? C6>65:2E:@? 4@DEDk^2m 24C@DD D64E@CD]k^Am

kAm|~'t:E :D @?=J @?6 @7 D6G6C2= G6?5@C\C6=2E65 3C62496D :? C646?E J62CD] #68F=2E@CD 92G6 C6DA@?565 244@C5:?8=J 3J 7@C>2=:K:?8 %!#| C6BF:C6>6?ED 24C@DD 7C2>6H@C<D 24C@DD E96 t& C68F=2E@CJ DA246[ H96C6 G6?5@C C:D< 244@F?E23:=:EJ :D 6?7@C465ik^Am

kF=mk=: 52E2\=:DE\:E6>\:5lQ6`5745c7h66gda243gg_b5h_2a_6e424hQmkDEC@?8mvs!#k^DEC@?8mi &?56C k2 9C67lQ9EEADi^^85AC\:?7@]6F^2CE\ag\85AC^QmpCE:4=6 agk^2m[ 4@?EC@==6CD 2C6 C6DA@?D:3=6 7@C 6?DFC:?8 E96:C AC@46DD@CD :>A=6>6?E 2AAC@AC:2E6 D64FC:EJ >62DFC6D[ 2?5 k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^4@==64E:@?^EAC>^E9:C5\A2CEJ\C:D<\C6BF:C6>6?ED\85ACQmC6>2:? =:23=6 :7 E96J 5@?’Ek^2m]k^=:mk=: 52E2\=:DE\:E6>\:5lQ6c`3375ehfh3446ceb62_f2eef3`f22hhQmkDEC@?8m}x$ ak^DEC@?8mi k2 9C67lQ9EEADi^^HHH]?:D\a\5:C64E:G6]4@>^}x$0a0s:C64E:G60pCE:4=60a`]9E>=QmpCE:4=6 a`k^2m C6BF:C6D @C82?:K2E:@?D E@ 2DD6DD 2?5 >2?286 4J36CD64FC:EJ C:D<D 24C@DD E96:C G6?5@C 64@DJDE6>]k^=:mk=: 52E2\=:DE\:E6>\:5lQ6g566cb344dfbg6dhdag37c747b`b`54aQmkDEC@?8ms~#pk^DEC@?8mi xr% E9:C5\A2CEJ C:D< >2?286>6?E :D 2 k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^C6D@FC46D^5@C2\d\A:==2CDQmDE2?52=@?6 A:==2Ck^2m H:E9 E9@C@F89 @G6CD:89E C6BF:C6>6?ED]k^=:mk^F=m

k9bm‍'6?5@C C:D< >2?286>6?E :D 2 G:D:3:=:EJ AC@3=6>k^9bm

kAmu@C >2?J E62>D[ G6?5@C C:D< :D DE:== >@DE=J :?G:D:3=6] %9:D :D 4@?46C?:?8 3642FD6 J@F 42??@E >2?286 H92E J@F 42?’E D66]k^Am

kAmk2 9C67lQ9EEADi^^HHH]G2?E2]4@>^DE2E6\@7\ECFDE^8=@32=Qm'2?E2’D $E2E6 @7 %CFDE #6A@CE Wa_adXk^2m 7@F?5 E92E @C82?:K2E:@?D DA6?5 ?:?6 H@C<:?8 H66<D 2 J62C @? G6?5@C C:D< 2DD6DD>6?ED 2?5 D64FC:EJ C6G:6HD] *6E deT DE:== 6IA6C:6?465 2 G6?5@C 3C6249 :? E96 A2DE J62C] x? E96 t&[ 2 k2 9C67lQ9EEADi^^HHH]AH4]=F^6?^AC6DD^AC6DD\C6=62D6D\a_ad^5@C2\=2J:?8\E96\8C@F?5H@C<]9E>=Qm!Hr {FI6>3@FC8k^2m DFCG6J 7@F?5 E92E dgT @7 7:C>D 36=:6G6 E92E E96:C E9:C5\A2CEJ AC@G:56CD DE:== 92G6 >2;@C 4@>A=:2?46 82AD 36EH66? 677@CE 2?5 @FE4@>6D]k^Am

kAm!=2:?=J[ >@DE @C82?:K2E:@?D 5@?VE 92G6 6?@F89 4@?E:?F@FD G:D:3:=:EJ :?E@ E9:C5\A2CEJ E9C62ED[ H9:49 D9@HD FA :? D6G6C2= H2JDik^Am

kF=mk=: 52E2\=:DE\:E6>\:5lQ6chdfea4che2f36dced3_6a43ha263`2_Qm}@ 46?EC2=:K65 :?G6?E@CJ @7 E9:C5 A2CE:6D 2?5 E96:C 2446DD]k^=:mk=: 52E2\=:DE\:E6>\:5lQ6_74h_7a36e2a6e2_6hd_d_dd66d447ddQmk2 9C67lQ9EEADi^^HHH]G2?E2]4@>^4@==64E:@?^EAC>^G6?5@C\@?3@2C5:?8Qmr@>A=:2?46 :D 2DD6DD65 2E @?3@2C5:?8k^2m[ E96? C2C6=J C6G:D:E65]k^=:mk=: 52E2\=:DE\:E6>\:5lQ6_ahe6`3fa5`2gh4cdaf3fgbbchedegf2Qm#6=:2?46 @? DE2E:4 BF6DE:@??2:C6D 2?5 D6=7\C6A@CE65 2EE6DE2E:@?D]k^=:mk=: 52E2\=:DE\:E6>\:5lQ6afe3e44`cbd_gbgaf624456g6e5gfd_dQm}@ C62=\E:>6 @G6CG:6H @7 G6?5@C D64FC:EJ A@DEFC6]k^=:mk^F=m

kAm~FE52E65[ >2?F2=\962GJ k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^4@==64E:@?^EAC>^G6?5@C\C:D<\>2?286>6?E\36DE\AC24E:46DQmG6?5@C C:D< >2?286>6?E AC24E:46Dk^2m 42? 4C62E6 :DDF6D] (9:=6 E9:C5\A2CEJ C:D< 492?86D 4@?E:?F@FD=J[ >2?J E62>D DE:== C6=J @? A@:?E\:?\E:>6[ 7C28>6?E65 C6G:6HD[ H9:49 =:>:E E96:C 23:=:EJ E@ >2<6 E:>6\D6?D:E:G6 C:D< 564:D:@?D] t& C68F=2E:@?D FA52E65 C6BF:C6>6?ED 2C@F?5 @?8@:?8 >@?:E@C:?8[ :?4:56?E C6A@CE:?8[ 2?5 >@C6 E@ 255C6DD E96D6 82AD :? 6I:DE:?8 %!#| >@56=D]k^Am

k9bm%!#| @3=:82E:@?Di w@H vs!#[ }x$ a[ 2?5 s~#p @G6C=2Ak^9bm

kAm(9:=6 E96 E9C66 C68F=2E:@?D 5:776C :? D4@A6 2?5 E6C>:?@=@8J[ E96:C E9:C5\A2CEJ C:D< @3=:82E:@?D 2=:8?ik^Am

kF=mk=: 52E2\=:DE\:E6>\:5lQ6ga4cb54fd7chg`a3d7b_6fc674h66h4_QmkDEC@?8mvs!#]k^DEC@?8m s2E2 AC@46DD:?8 28C66>6?ED[ AC@46DD@C 5F6 5:=:86?46[ 2?5 3C6249 ?@E:7:42E:@? @3=:82E:@?D WE96 fa\9@FC H:?5@H 2AA=:6D E@ E96 k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^4@==64E:@?^85AC^52E2\4@?EC@==6C\2?5\AC@46DD@CDQm4@?EC@==6C 6G6? :7 E96 AC@46DD@Ck^2m :D 3C624965Xk^=:mk=: 52E2\=:DE\:E6>\:5lQ6be4d4ceag64d7h255ee4g7`e52ec4h7_QmkDEC@?8m}x$ ak^DEC@?8m] $FAA=J 492:? C:D< 2DD6DD>6?ED[ D64FC:EJ 4C:E6C:2 :? G6?5@C 4@?EC24ED[ 2?5 :?4:56?E C6A@CE:?8 24C@DD 5@H?DEC62> 56A6?56?4:6Dk^=:mk=: 52E2\=:DE\:E6>\:5lQ6fd62``7bc`c_453bb557db6b4ag7be`5QmkDEC@?8ms~#pk^DEC@?8m] xr% E9:C5\A2CEJ C:D< C68:DE6CD[ @?8@:?8 >@?:E@C:?8 7@C 4C:E:42= D6CG:46 AC@G:56CD[ G6?5@C @773@2C5:?8 AC@465FC6D[ 2?5 4@?46?EC2E:@? C:D< >2?286>6?E W6]8][ 2G@:5:?8 @G6C\C6=:2?46 @7 <6J G6?5@CDXk^=:mk^F=m

kAmp== E9C66 C6BF:C6 4@?E:?F@FD G6?5@C 2DD6DD>6?ED[ D64FC:EJ @3=:82E:@?D 3F:=E :?E@ 4@?EC24ED[ 2?5 :?4:56?E C6A@CE:?8 24C@DD E96 6?E:C6 G6?5@C 64@DJDE6>]k^Am

kAm%9:C5\A2CEJ C:D< >2?286>6?E H@C< D9@F=5?’E 36 D:=@65 24C@DD 7C2>6H@C<D] |2?28:?8 4@?EC@=D 7@C 6249 :? :D@=2E:@? 42? 67764E:G6=J EC:A=6 E96 677@CE 7@C E96 D2>6 C6DF=ED] $EC62>=:?:?8 E96 677@CED 2=D@ C65F46D E96 @G6CD:89E C:D< E92E 42? EC:886C 4@>A@F?5:?8 G:@=2E:@?D] %96 k2 9C67lQ9EEADi^^DJ?5:D]4@>^:?D:89ED^E96\36DE\4@>A=:2?46\D@7EH2C6\7@C\6FC@A62?\4@>A2?:6D\:?\a_aeQm=625:?8 4@>A=:2?46 D@=FE:@?D 7@C tFC@A62? @C82?:K2E:@?Dk^2m 255C6DD E9:D 3J >2AA:?8 4@?EC@=D 24C@DD 7C2>6H@C<D[ 6=:>:?2E:?8 C65F?52?E H@C< H9:=6 >2:?E2:?:?8 7F== C68F=2E@CJ 4@G6C286]k^Am

k9bmw@H >F49 2 vs!#[ }x$ a[ @C s~#p G:@=2E:@? 42? 4@DEk^9bm

kAm%9:C5\A2CEJ 3C62496D F?56C t& C68F=2E:@?D 42? C6DF=E :? D:8?:7:42?E A6?2=E:6Dik^Am

kF=mk=: 52E2\=:DE\:E6>\:5lQ64g6`g2h4c42eafc`ccd`h5b2`g2e7ah4QmkDEC@?8mvs!#k^DEC@?8m] &A E@ €a_| @C cT @7 8=@32= EFC?@G6C 7@C E96 AC6G:@FD 7:D42= J62C] $:?46 a_`g[ 4F>F=2E:G6 7:?6D 92G6 6I466565 €f]`qk^=:mk=: 52E2\=:DE\:E6>\:5lQ6edh55g_3dae3h65_4`_gchb75__4ehfbQmkDEC@?8m}x$ ak^DEC@?8m] &A E@ €`_| @C aT @7 8=@32= EFC?@G6C 7@C 6DD6?E:2= 6?E:E:6D[ H:E9 A@E6?E:2= A6CD@?2= =:23:=:EJ 7@C D6?:@C >2?286>6?E]k^=:mk=: 52E2\=:DE\:E6>\:5lQ67a4b2bc3b23666f7`_2f2b`2_3455cdgQmkDEC@?8ms~#pk^DEC@?8m] &A E@ aT @7 8=@32= 2??F2= EFC?@G6C 7@C @C82?:K2E:@?D[ @C FA E@ €`| 7@C :?5:G:5F2=D] rC:E:42= xr% AC@G:56CD >2J 7246 7:?6D @7 FA E@ €d|[ A=FD 2? 255:E:@?2= 52:=J A6?2=EJ @7 `T @7 2G6C286 52:=J EFC?@G6C]k^=:mk^F=m

kAm%96 24EF2= :>A24E @? J@FC @C82?:K2E:@? 32==@@?D H96? 2 D:?8=6 G:@=2E:@? C6DF=ED :? 4@>A@F?565 =:23:=:EJ H:E9 D6C:@FD 7:?2?4:2= 2?5 @A6C2E:@?2= 4@?D6BF6?46D] %92E 7:?2?4:2= =:23:=:EJ 42? D42=6 C2A:5=J :7 J@F 7246 s~#p A6?2=E:6D[ 2D E96 C68F=2E:@?’D 52:=J 244CF65 A6?2=E:6D @7 FA E@ d >:==:@? 6FC@D 4C62E6 2 “3FC? C2E6” E92E 76H 32=2?46 D966ED 42? DFDE2:?] q6J@?5 E96 7:?6D[ @C82?:K2E:@?D 7246 2 4@?EC24EF2= :?56>?:EJ 82A] '6?5@CD EJA:42==J 42A E96:C =:23:=:EJ 2E 2 7:I65 2>@F?E[ H9:49 C2C6=J C67=64ED E96 ECF6 4@DE @7 2 72:=FC6[ =62G:?8 J@FC @C82?:K2E:@? E@ 23D@C3 >@DE @7 E96 C68F=2E@CJ 2?5 7:?2?4:2= :>A24E]k^Am

kAmuFCE96C>@C6[ E96 C6AFE2E:@?2= 52>286 :D A6C>2?6?E] rFDE@>6CD 5@?’E 2=H2JD <?@H E96 5:776C6?46 36EH66? J@FC 3C6249 2?5 2 G6?5@C’D] |62?H9:=6[ qaq 3FJ6CD ?@H G:6H 2 =24< @7 G6?5@C G:D:3:=:EJ 2D 2 5:DBF2=:7J:?8 D64FC:EJ 72:=FC6]k^Am

kAm(96? C68F=2E@CD—2?5 4FDE@>6CD—9@=5 J@F 244@F?E23=6 7@C J@FC G6?5@CD’ D64FC:EJ[ ECFDE ;FDE 92D E@ 36 4@?E:?F@FD=J G6C:7:65[ ?@E 2??F2==J]k^Am

k9bm%9C66 C68F=2E@CD[ @?6 4@>>@? 5:C64E:@? 7@C E9:C5\A2CEJ C:D<Dk^9bm

kAmvs!#[ }x$ a[ 2?5 s~#p 2== C6:?7@C46 E96 D2>6 6IA64E2E:@?i ac^f G6?5@C C:D< 244@F?E23:=:EJ] %C25:E:@?2= %!#| 2AAC@2496D 42?’E @776C E9:D =6G6= @7 2DDFC2?46] $E2E:4 6G:56?46 2?5 A@:?E\:?\E:>6 C6G:6HD 7C@> 2 >@?E9 28@ 92G6 ?@ G2=F6 :7 J@F 92G6 E@ 2?DH6C 7@C C62=\E:>6 C:D<D :? J@FC DFAA=J 492:?]k^Am

kAm%92E 3C:?8D FD E@ E96 >@DE @3G:@FD BF6DE:@?i x7 C68F=2E@CD 3J 5672F=E E9:?< J@FC G6?5@CD 2C6 2 AC@3=6>[ 5@ J@F 92G6 E96 G:D:3:=:EJ E@ AC@G6 @E96CH:D6nk^Am

kAm~C82?:K2E:@?D ?2G:82E:?8 tFC@A6’D C68F=2E@CJ =2?5D42A6 >FDE 36 23=6 E@ 252AE E@ E9:D D9:7E BF:4<=J 2?5 EC62E G6?5@C C:D< 2D 2 4@?E:?F@FD 5:D4:A=:?6 :?DE625 @7 2 AC@4FC6>6?E 4964<3@I]k^Am

kAmk2 9C67lQ9EEADi^^HHH]G2?E2]4@>^C6D@FC46D^6FC@A6\C68F=2E:@?D\2?5\G6?5@C\C:D<Qmk6>m%9:D DE@CJk^6>mk^2m k6>mH2D AC@5F465 3Jk^6>m k2 9C67lQ9EEADi^^HHH]G2?E2]4@>^AC@5F4ED^8C4Qmk6>m'2?E2k^6>mk^2m k6>m2?5 C6G:6H65 2?5 5:DEC:3FE65 3Jk^6>m k2 9C67lQ9EEADi^^9F3D]=2^"_b<=8$#_Q C6=lQ?@7@==@HQmk6>m$E24<6Ck^6>mk^2m]k^Am