In 2026, third-party risk management (TPRM) is a key audit topic. Three rules drive it:
- NIS-2 Art. 21(2)(d) makes supply chain security a clear duty.
- ISO 27001 A.5.19–22 calls for a structured review of suppliers.
- GDPR Art. 28 requires data processing agreements, with checks that they work, on record.
If you handle this ad hoc through mailing lists, you lose track. And you lose the audit.
What a Modern TPRM System Gives You
- Supplier list: one central list with business area, how critical each supplier is, contract status, and which way data flows.
- Self-service questionnaires: the supplier fills in the security questionnaire right in the portal. No more PDFs sent back and forth by mail.
- Evidence upload: the supplier uploads certificates (ISO 27001, SOC 2, BSI), sub-processor lists, and pen-test reports. Reminders go out on their own before a file expires.
- Risk score: built from the answers, the evidence, and the criticality rating. You get a formula you can follow, not a gut feeling.
- Review rhythm: the yearly update is requested on its own. If the supplier does not deliver, it escalates.
Self-Service Makes the Real Difference
Here is the classic way to run a security questionnaire. The compliance officer mails a PDF to the supplier. Three weeks later, the supplier sends back a filled-in PDF. Then the compliance officer types the answers into the internal system by hand. That takes many rounds and lots of Excel.
With self-service, it works like this:
- The supplier gets a login. It needs no password: a magic link, or OIDC if the supplier has it.
- The supplier fills in the questionnaire right in the portal.
- The supplier uploads evidence as files and signs confirmations digitally.
- The compliance officer sees progress live and comments right in the answer field.
- Questions get cleared up without mails going back and forth.
Risk Scoring That Isn't Random
The risk score is built in the open from these factors:
- Data class: what data does the supplier process? (public → personal → special categories)
- Depth of access: only order data, or access to production?
- Location: EU only, a third country with an adequacy decision, or one without?
- Certification status: ISO 27001 in place? SOC 2 Type II? BSI certification?
- Sub-processor depth: how many links does the supply chain have?
You can set each factor in the platform. The defaults follow ISO 27001 best practices.
How It Links to the ISMS
Suppliers don't stand alone. They connect to assets, risks, and measures:
- Asset link: each asset with an outside provider links to the supplier entry on its own.
- Risk impact: supplier risks land in the central risk register. The tool suggests treatment measures for them.
- Review cycle: yearly supplier reviews run through the review cycle manager, with reminders on more than one channel.
- Contract store: DPA, NDA, and contract changes are kept in OnlyOffice, with full-text search.
What the Auditor Likes to See
- A supplier list sorted by criticality as a CSV export.
- An evidence folder per supplier with the dates when certificates expire.
- An audit trail of risk sign-offs: who accepted the supplier's risk score, and when.
- A sub-processor list, posted to the trust center on its own.
What Setup Really Takes
For 50 active suppliers, plan on this: 2 days to set it up at the start (question templates, risk formula). Then 1 day to bulk import the data you have. After that, it takes about 2 hours a week to run. As a rule, the payoff in the first audit alone covers the setup work.
Conclusion
In 2026, TPRM is no longer optional. Audits demand it. The only answer that scales is a self-service portal. It needs a clear risk score, an automatic review rhythm, and links to the ISMS and the trust center. TPRM by mailing list breaks down by the 30th supplier at the latest. Self-service can carry 1,000.