Risk areas
- Information security: can an attack on the supplier hit you?
- Compliance and sanctions: is the supplier listed or involved in breaches?
- Finance: could an insolvency stop your supply?
- Data protection: does the supplier process personal data for you?
- Resilience: how fast can you replace it, and do many suppliers depend on the same provider?
- ESG and human rights: environment, working conditions and country risk.
The life cycle
- Plan and selectDefine the requirements a supplier must meet before you choose.
- Due diligenceBefore the contract, check master data, sanctions lists, security and evidence.
- ContractAgree incident reporting, audit rights, subcontractors and exit.
- MonitorWatch what changes: certificates, incidents, public setup.
- ReassessReassess on the agreed cycle and after major events.
- ExitEnsure your data is returned or deleted and remove all access.
Legal framework
- Austria: supply chain security under § 32 (4)(d) NISG 2026, in force since 1 October 2026.
- EU: the same duty in Article 21(2)(d) and (3) of the NIS2 Directive.
- Financial sector: ICT third-party risk under Articles 28 to 30 DORA, applicable since 17 January 2025.
- Data protection: processors with sufficient guarantees and a contract under Article 28 GDPR.
- Sustainability: EU CSDDD, transposition by 26 July 2028, application from 26 July 2029 (Article 37(1)).
Checklist: TPRM basics
These points belong in every programme, whatever its size.
- Complete list of all suppliers and service providers.
- Risk classification with documented criteria.
- Requirements per tier: questions, evidence, cycle.
- A responsible person per supplier.
- Review before the contract, monitoring afterwards.
- Findings with deadline and follow-up.
- Regular report to management.
- Exit defined: data returned, access removed.
You may copy and adapt this list freely.
Frequently asked questions
How does TPRM differ from supplier management?
Supplier management steers performance, cost and cooperation. TPRM looks at the risks a supplier brings. In practice they work together.
Do small companies need TPRM?
Yes, at the right size. A list with classification and evidence for the key suppliers already lowers the risk.
What is fourth-party risk?
The risk from your suppliers' suppliers, such as a shared cloud provider. If it fails, many of your suppliers fail at once.
Sources
- NISG 2026, § 32 (4)(d), BGBl. I Nr. 94/2025
- NIS2 Directive, Article 21, Directive (EU) 2022/2555
- DORA, Articles 28 to 30 and 64, Regulation (EU) 2022/2554
- GDPR, Article 28, Regulation (EU) 2016/679
- CSDDD, Article 37, Directive (EU) 2024/1760, version of 18 March 2026
Legal sources checked on 31 October 2026. Legal information, not legal advice. For your own case, please ask a professional. The German version is binding.