---
title: "Treat third-party risk management as a regulatory requirement, not just a best practice."
impact: CRITICAL
impactDescription: "essential for correctness or security"
tags: cybersecurity-compliance, legal, nis2, dora, sec-cybersecurity-rules
---

## Treat third-party risk management as a regulatory requirement, not just a best practice.

NIS2, DORA, and many industry frameworks require formal assessment and ongoing monitoring of your supply chain's cybersecurity posture. Maintain an inventory of critical suppliers and their security certifications.