Third-party risk management in 2026: from questionnaire fatigue to continuous assurance

Supplier questionnaires are multiplying while regulators ask for more than paperwork. Here is how to rebalance third-party risk management around concentration risk, continuous monitoring and published assurance.

Third-party risk management (TPRM) has become one of the most labour-intensive parts of a security and compliance programme. Every customer sends its own questionnaire, every supplier answers hundreds of them, and much of the effort produces documents that are out of date within months. At the same time, European regulation now expects organisations to prove that they understand and control their supply chain. This article looks at what has changed in 2026 and how to build a TPRM process that is both defensible and sustainable.

Why supplier risk is now a regulatory issue

Third-party exposure is not a theoretical concern. Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in breaches had doubled to 30% ^[1]. Regulators have responded by writing supplier oversight into law.

NIS2

Article 21(2)(d) of NIS2 lists supply chain security, “including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”, among the minimum cybersecurity risk-management measures ^[2]. Article 21(3) adds that entities must take into account the vulnerabilities specific to each direct supplier and the overall quality of its products and cybersecurity practices ^[2].

For digital infrastructure and digital service providers (cloud, data centres, managed service and managed security service providers, among others), Implementing Regulation (EU) 2024/2690 makes this concrete: a supply chain security policy, criteria for selecting suppliers, contractual security requirements and regular monitoring of supplier practices ^[3]. ENISA’s Technical Implementation Guidance of June 2025 adds examples of evidence that supervisors may expect ^[4]. For other NIS2 entities these documents are not binding, but they are a sensible benchmark.

DORA

For financial entities, DORA is more prescriptive. Article 28 requires a strategy on ICT third-party risk and a register of information covering all contractual arrangements with ICT third-party service providers ^[5]. Article 29 requires a preliminary assessment of ICT concentration risk before entering into contracts that support critical or important functions, including whether the provider is easily substitutable and whether multiple contracts with the same or closely connected providers are being concluded ^[5].

A questionnaire tells you what a supplier said on one day; your risk depends on what the supplier does every day.

Questionnaire fatigue: the symptoms and the cause

Questionnaire fatigue affects both sides. Buyers send long generic questionnaires to every supplier regardless of risk. Suppliers answer the same questions in slightly different formats, often through sales or account teams rather than security staff. The result is a large volume of self-declared answers that are rarely verified and quickly become stale.

The underlying problem is not the questionnaire itself but the lack of tiering. When every supplier is assessed in the same way, the effort is spread thinly and the few suppliers that really matter receive no more scrutiny than a catering contractor.

A risk-tiered approach

A more sustainable model starts with classification:

• Criticality: does the supplier support a critical or important function, or would its failure disrupt your services?
• Data access: does it process personal data, confidential information or credentials?
• System access: does it connect to your network, operate your systems or deliver software into your environment?
• Substitutability: how quickly could you replace it?

Low-risk suppliers may need only contractual clauses and a basic declaration. High-risk suppliers justify deeper review: independent certifications, audit reports, contractual audit rights, incident notification commitments and periodic reassessment.

Concentration risk moves up the agenda

Concentration risk asks a different question from classic due diligence: not “is this supplier secure?” but “what happens if this supplier, or the provider behind it, fails?”

Under DORA, this is now a supervisory theme. On 18 November 2025 the European Supervisory Authorities (EBA, EIOPA and ESMA) published the first list of designated critical ICT third-party providers, which are now subject to direct EU oversight ^[6]. Designation does not remove a financial entity’s own responsibility: entities still have to manage their exposure to those providers through exit strategies and substitutability analysis ^[5].

Outside financial services, the same logic applies. Many SaaS suppliers run on a small number of hyperscale cloud platforms. Mapping your fourth parties (your suppliers’ key subcontractors) is often the only way to see that ten “independent” suppliers share a single point of failure. Implementing Regulation 2024/2690 explicitly expects relevant entities to consider their suppliers’ own supply chains ^[3].

From point-in-time to continuous monitoring

A questionnaire tells you what a supplier said on one day; your risk depends on what the supplier does every day. Continuous vendor monitoring aims to close that gap. In practice it combines:

• Event-driven reassessment: triggers such as a supplier security incident, a change of ownership, a new subprocessor or a change in the service you consume.
• Certificate and attestation tracking: expiry dates for ISO/IEC 27001 certificates, SOC 2 reports and similar evidence, with follow-up when they lapse.
• External signals: public breach disclosures, regulatory actions and, where useful, external attack surface ratings. Treat ratings as indicators to investigate rather than as verdicts, since they observe only what is visible from the internet.
• Contractual hooks: incident notification deadlines, audit rights and the obligation to inform you of material changes.

Monitoring is only valuable if someone acts on the findings. Assign an owner for each high-risk supplier and record decisions: accept, mitigate, escalate or exit.

Why trust centres are gaining ground

A trust centre is a public or gated web page where a supplier publishes its security and compliance posture: certifications, audit reports (often behind a non-disclosure agreement), policies, subprocessor lists, data location and answers to common questions. The idea is to answer once, publicly, instead of repeatedly in private.

The concept is not new. The Cloud Security Alliance’s STAR Registry has for years allowed cloud providers to publish self-assessments based on the Consensus Assessments Initiative Questionnaire (CAIQ), or third-party certifications and attestations, explicitly to reduce the need to complete multiple customer questionnaires ^[7].

What trust centres do well

• They give buyers immediate access to standard evidence, which shortens procurement cycles.
• They encourage suppliers to keep information current, because it is visible.
• They let security teams spend time on follow-up questions that actually matter.

Where they fall short

• Published content is selected by the supplier. It shows what the supplier chooses to share, not necessarily what you need to know.
• Generic documents do not address your specific use of the service, data flows or integration.
• Regulatory duties remain yours. Neither NIS2 nor DORA lets you outsource your assessment to a supplier’s marketing page ^[2][5].

The practical answer is a hybrid: use trust centres and shared assessments as the default evidence source, then send targeted follow-up questions only for gaps that are material to your risk.

A practical checklist for 2026

1. Build and maintain a single supplier inventory, aligned with the DORA register of information where relevant.
2. Tier suppliers by criticality, data access, system access and substitutability.
3. Map key fourth parties for your highest-tier suppliers.
4. Accept trust centre content, certifications and standard questionnaires as primary evidence; reserve custom questions for genuine gaps.
5. Define reassessment triggers and track evidence expiry.
6. Document exit strategies for critical suppliers and test them where feasible.
7. Report supplier risk to management in terms of business impact, not questionnaire scores.

Conclusion

Third-party risk management in 2026 is less about collecting more answers and more about knowing which suppliers matter, why, and what you would do if they failed. Regulation now requires that reasoning to be documented.

Secrato helps organisations manage frameworks such as NIS2, DORA and ISO 27001 in one EU-hosted platform, with shared controls, evidence and audit trails.