Supplier risk glossary

Data processing agreement (DPA)

A contract with a provider that processes personal data on your behalf. Article 28(3) GDPR sets the minimum content, such as subject, duration, purpose and types of data. Read more: Data protection and GDPR

Outside-in check

A passive check from outside: it reads only what is public, such as DNS records, encryption and security headers. No port scans, no attacks. Read more: Self-test

CSDDD

EU Corporate Sustainability Due Diligence Directive (EU) 2024/1760. It applies to very large companies. One case: more than 5,000 employees and more than EUR 1.5 billion worldwide turnover (Article 2(1)(a)). Transposition by 26 July 2028, application from 26 July 2029 (Article 37(1)). Read more: ESG and human rights

DORA

Regulation (EU) 2022/2554 on digital operational resilience in the financial sector. It has applied since 17 January 2025 (Article 64) and also governs ICT third-party risk. Read more: DORA and ICT third-party providers

Due diligence

A careful review of a business partner, before the contract and at intervals afterwards.

Essential or important entity

Companies and bodies that the NISG 2026 places under cybersecurity duties. They must also secure their supply chain (§ 32 NISG 2026). Read more: NIS2 and NISG 2026 in the supply chain

Company register (Firmenbuch)

The public register of companies in Austria, with register number, legal form, seat and authorised representatives.

ICT third-party provider

A provider of information and communication technology to a financial entity, such as cloud, software or data centre. A DORA term.

ISO/IEC 27001

International standard for information security management systems. A certificate shows that an accredited body has audited the system. Check scope and expiry date.

Concentration risk

Many suppliers or services depend on the same provider. If it fails, you are hit several times. DORA covers it in Article 29. Read more: Resilience

LEI

Legal Entity Identifier, a worldwide unique code for companies. The open GLEIF index shows name, address and often the parent company. Read more: Finance

Supplier assessment

Regular rating of suppliers against fixed criteria such as quality, delivery, cost and security. Read more: Supplier assessment

Supplier management

Steering suppliers from selection through cooperation to exit. Risk management is part of it. Read more: Third-party risk management (TPRM)

Supplier portal

Web access where suppliers answer questionnaires, upload evidence and correct findings. Read more: Information security and NIS2

Supplier self-disclosure

A supplier's statements on master data, contacts, certificates and principles along your questions. Read more: Supplier self-disclosure and questionnaire

Supply chain act

Common name for laws on due diligence in the supply chain. At EU level this is the CSDDD.

Evidence

Proof of a statement, such as a certificate, a test record or a contract. Good evidence has an expiry date.

NIS2

Directive (EU) 2022/2555 on a high common level of cybersecurity. Article 21(2)(d) requires supply chain security. Read more: NIS2 and NISG 2026 in the supply chain

NISG 2026

Austrian Network and Information Systems Security Act 2026, BGBl. I Nr. 94/2025. In force since 1 October 2026; § 32 (4)(d) covers the supply chain. Read more: NIS2 and NISG 2026 in the supply chain

Grade

Result of an assessment from A to E. With us, every grade has a calculation: each signal with source and date. Read more: Methodology

Sanctions list

An official list of persons and organisations under sanctions. Publishers include the EU, the UN, the US, the UK and Switzerland. Read more: Sanctions screening

security.txt

A file on a website that states where to report vulnerabilities. Defined in RFC 9116.

SPF and DMARC

DNS records that make forged email senders harder. They are part of the basics of the outside-in check. Read more: Self-test

Tier

Classification of a supplier from 1 (critical) to 4 (low). It follows from data, access, importance, replaceability and spend and sets the depth of review.

TISAX

An assessment and exchange scheme for information security, common in the automotive industry.

TPRM

Third-party risk management: identifying, assessing, monitoring and documenting risks from third parties. Read more: Third-party risk management (TPRM)

VAT number

VAT identification number. VIES, the European Commission's register, shows whether it is valid. Read more: Finance

Fourth parties

Your suppliers' suppliers, such as a shared cloud provider. Read more: Resilience

Legal information, not legal advice. For your own case, please ask a professional. The German version is binding.