Supply chain risk
Also called supply chain security risk, ICT supply chain risk
Supply chain risk is the risk that a failure, attack or disruption at a supplier, or at one of its own suppliers, damages a firm's operations, data or customers. For financial firms it centres on technology and software providers, their subcontractors and shared components. The risk reaches beyond direct contracts into fourth and fifth parties.
How it works
Firms map which suppliers support important services and which subcontractors those suppliers rely on. They ask critical providers to disclose key subcontractors, software components and hosting locations, and they track shared dependencies such as a single cloud region or software library used by many vendors. Contracts set notification duties for subcontractor changes and security incidents. Risk teams monitor for incidents affecting any link in the chain.
A single compromised software update or failed provider can hit thousands of firms at once, as several cyber incidents have shown. EU rules now name supply chain security as a required control area, and US federal standards set detailed practices. Supervisors also watch concentration, where many firms depend on the same few providers. Firms that cannot see beyond their direct suppliers struggle to assess impact quickly during an incident.
The rules
Lists supply chain security, including security of relationships with direct suppliers and service providers, among required cybersecurity measures.
Essential and important entities, including banks and financial market infrastructureRequires firms to manage ICT third-party risk, including subcontracting chains supporting critical or important functions.
EU financial entitiesSets practices to identify, assess and mitigate cybersecurity risks across the supply chain at organisational, mission and system levels.
US federal agencies, widely used by financial firmsCommon questions
How is supply chain risk different from third-party risk?
Third-party risk usually covers a firm's direct suppliers. Supply chain risk extends to the suppliers of those suppliers, shared software components and infrastructure, and the knock-on effects of a failure anywhere in that chain.
What is a fourth party?
A fourth party is a supplier's own supplier, such as the cloud provider hosting a firm's software vendor. Firms usually have no contract with fourth parties, so they rely on disclosure and contract terms with the direct supplier.
Do financial regulators cover subcontractors?
Yes. DORA and EU outsourcing guidelines require firms to assess and control subcontracting of critical or important functions. UK and US guidance expects firms to understand material subcontractors used by their providers.
Does supply chain risk include ESG risk?
In a broader sense, yes. Human rights, environmental and modern slavery risks in a supplier's chain fall under sustainability and due diligence rules, separate from the cyber and operational focus of financial regulators.
Our coverage
News and analysis on third-party risk from RegTech Post.
Read the coverage →RegTech PostManaging Third-Party Risk: What Legal Teams Must Focus on in 2026Read the article →RegTech PostThird-Party Risk Management and AI: What Boards Need to KnowRead the article →
