TPRM · Compliance

Compliance in Supplier Management

Compliance in supplier management ensures that suppliers meet legal, regulatory and contractual requirements — with demonstrable documentation.

Compliance in supplier management covers all measures that ensure suppliers meet relevant legal, regulatory and internal requirements — from GDPR and ISO 27001 to NIS2 and DORA.

Relevant compliance requirements

The most important compliance requirements in supplier management: GDPR Art. 28 (data processing — contracts with processors), NIS2 Art. 21 (supply chain security), DORA Art. 28-44 (ICT third-party management), ISO 27001 Annex A.5.19-23 (supplier relationships), BSI IT-Grundschutz (module OPS.2.1 outsourcing).

Automated compliance monitoring

360TPRM continuously monitors the compliance status of all suppliers — with automatic alerts for certificate loss or compliance deviations.

Evidence and documentation

Compliance without evidence is worthless. NIS2, DORA and ISO 27001 all require complete documentation of compliance measures — audit-ready and retrievable at any time. Supervisory authorities can request evidence at short notice. 360TPRM automatically creates complete compliance reports.

Burden of proof lies with the organisation

Under NIS2 and DORA, the burden of proof lies with the organisation. Those unable to demonstrate documentation are presumed non-compliant.

FAQ

What is the difference between compliance and risk management?+

Compliance checks adherence to external requirements. Risk management assesses and manages internal risk tolerance. In TPRM, both are inseparable.

How is supplier compliance checked?+

Through certificate reviews, questionnaires, external scans (like 360TPRM) and on-site audits for critical suppliers.

Demonstrate supplier compliance

See in a 45-minute demo how 360TPRM specifically meets your requirements.

Request free demo →