Fresh insights, the 3rdRisk blog

We’re excited to announce that 3rdRisk has been featured in Gartner’s Market Guide for Third-Party Risk Management Technology Solutions. This recognition highlights our position as an innovative European player making a global impact, thanks to an easy-to-implement, AI-driven platform. A big thank you to our customers, partners, and team for helping us achieve this milestone.

Verdantix highlights 3rdRisk as a key innovative solution provider in its latest blog on DORA compliance. As most financial institutions continue to grapple with the demands of the EU’s Digital Operational Resilience Act, 3rdRisk stands out with a platform that simplifies compliance through automation, real-time insights, and built-in regulatory content—empowering firms to move from reactive to resilient.

The DORA Register of Information (RoI) is a new requirement for financial institutions, asking for detailed records of contracts with third-party ICT providers. In this article, we share 5 practical tips to help you implement and maintain an effective DORA RoI that keeps you compliant and strengthens your operational resilience.

We’ve launched a new Sanctions Screening module, fully integrated into the 3rdRisk platform. Screen entities using data from OpenSanctions.org—including sanction lists, PEPs, KYB datasets, and more—without switching tools. It’s part of our mission to eliminate silos, reduce manual work, and deliver a 360° view of third-party risks.

As supply chain security becomes increasingly crucial, the NIS2 directive mandates that organisations implement robust cybersecurity measures. A risk-based approach is essential, starting with third-party classification and due diligence based on frameworks like ISO 27001 and NIST. Ownership and clear roles within the organisation play a pivotal role in ensuring compliance and effective supply chain risk management. Additionally, adopting a unified framework and leveraging smart tools like 3rdRisk can streamline security efforts, automate compliance tasks, and enhance resilience against cyber threats. By integrating these strategies, businesses can secure their supply chains and stay NIS2-compliant efficiently.

Sustainability in third-party risk management is shifting from a PR focus to a business-critical priority. In the latest RiskTalk podcast, Jille Luijckx (Deloitte) and Bram Ketting (3rdRisk) discuss the impact of CSRD and CSDDD regulations, practical supplier segmentation, and the role of technology in managing ESG risks. Organisations must act now to build a competitive advantage—waiting is no longer an option.

DataExpert and 3rdRisk have partnered to help organisations identify and mitigate cyber risks in their supply chains. By integrating the 3rdRisk platform into its Third-Party Risk Management (TPRM) services, DataExpert enhances client protection, reduces costs, and ensures compliance with regulations like NIS-2 and DORA.

Supply Chain Management (SCM) is evolving from a cost-focused approach to one centred on risk management and regulatory compliance. With increasing threats such as cyberattacks and supply chain disruptions, businesses must prioritise Third-Party Risk Management (TPRM) and Supply Chain Risk Management (SCRM). European regulations like NIS2, DORA, and CSDDD are imposing stricter requirements on organisations, demanding greater transparency and security. Companies must adopt proactive strategies, including stringent data security measures and robust compliance frameworks, to safeguard operations and maintain business continuity in a rapidly changing landscape.

In this episode of RiskTalk, we delve into the importance and necessity of monitoring third parties. What exactly is it, why is it so crucial, and what should you pay attention to? Our guests are Peter van den Toorn, CEO of Business Radar, and Sem de Spa, Director at Deloitte specialising in sustainability technology.

3rdRisk is proud to announce its official partnership with Deloitte in the USA. In response to the growing demand for user-centred third-party risk management technology in the USA, this collaboration aims to help enterprises tackle risks arising from third-party collaborations, supply chain complexity, and regulatory compliance.

3rdRisk is proud to be featured in the latest Market and Buyer’s Guide for Third-Party Risk Management as a notable provider of third-party risk management technology.

In this episode of RiskTalk, Berry Kok (Manager Risk & Internal Audit at HEMA), Anouk Jessurun (founder of Winitstreet, specialising in risk training), and our Bram Ketting share practical insights on the role of employees in risk management. They discuss how, with the right tools and engagement, employees can actively contribute to identifying and mitigating risks within the third-party chain.

Third-party security questionnaires are vital for managing vendor risks, but common pitfalls can undermine their effectiveness. To optimise results, CISOs should: simplify questionnaires for better responses, tailor them to vendor risk levels, adopt a centralised assessment approach, align with industry frameworks like ISO 27001, and clearly explain the importance of the process to vendors.

The introduction of the European NIS2 Directive presents businesses with a significant challenge in strengthening their digital resilience. In the fourth episode of 3rdRisk’s RiskTalk podcast, three experts discuss the impact and practical implications of NIS2: Jasper Nagetaal (RDI), Willem van der Valk (Eraneos) and our own Bram Ketting.

We are proud to announce that 3rdRisk has been recognised in Verdantix's "Smart Innovators: Reputational Risk Software 2024" report, published in November 2024. This acknowledgment underscores our commitment to advancing risk management and compliance for organisations managing third-party relationships, especially when navigating the complexities of contractors, governance, and reputational risks.

In the latest episode of Risk Talk, the podcast by 3rdRisk, the spotlight is on the role of artificial intelligence (AI) in third-party risk management (TPRM). Experts Harm Kuiper (Deloitte), Lars Wiegers, and Bram Ketting (3rdRisk) share their insights on how AI supports risk professionals in managing risks, the tangible benefits it offers, and the challenges it presents.

NTT DATA and 3rdRisk have released a whitepaper exploring Third-Party Risk Management (TPRM) in the Energy & Utilities sector. As the sector increasingly relies on external partners for efficiency and innovation, effective TPRM is essential to safeguard operations. The whitepaper provides insights into key risks, benefits of robust TPRM, and NTT DATA’s tailored solutions to address industry-specific challenges.

The EU’s Corporate Sustainability Reporting Directive (CSRD) requires large companies and some non-EU businesses to report their ESG performance every year. It builds on an earlier directive, expanding the rules to more companies. This blog explains what the CSRD is, why it matters, and how businesses can prepare for it.

In the first episode of our new podcast RiskTalk, the Digital Operational Resilience Act (DORA) is discussed. DORA is a European regulation designed to enhance the digital resilience of the financial sector by requiring companies to manage IT risks carefully. Want to learn more about how to prepare your organisation for DORA? Listen to the full episode of the RiskTalk podcast and discover how to integrate digital resilience into the core of your business strategy.

Procurement is essential for managing third-party risks, preventing financial losses, fines, and reputational damage. Procurement teams assess and reduce risks, ensure compliance, and adapt to regulations like the German Supply Chain Act and GDPR. Through due diligence, monitoring, and technology, procurement strengthens supplier relationships and enhances resilience.

This blog post aims to provide a comprehensive understanding of DORA, its key requirements, and how financial entities can master compliance. We will delve into the specifics of the regulation, its implications for financial entities, and explore solutions that can simplify the path to compliance.

The Digital Operational Resilience Act (DORA) and its Draft Regulatory Technical Standards (RTS) provide a comprehensive framework for managing ICT third-party risks in the financial sector. In this blog post, we take a closer look at the requirements included in the RTS.

This is the fifth in a six-part blog series on getting started with third-party risk management. In this blog post, we will continue our implementation with the foundation of third-party risk management: due diligence assessments such as self.-assessments, audits and external data on your third-party risk posture.

In this blog post, we take a closer look at the EU Deforestation regulation. This regulation, effective in 2024, aims to prevent deforestation and forest degradation by regulating the import and export of commodities like palm oil, soy, cattle, coffee, and timber within the EU market.

This is the fourth in a six-part blog series on getting started with third-party risk management. In this new blog post, we will discuss the importance and implementation of a segmentation strategy. This segmentation will inform the extent to which and how you should perform due diligence on your third-party relations.

The German Supply Chain Act (LkSG), effective since 1st January 2023, enforces strict due diligence obligations on companies to address human rights and environmental risks within their supply chains. Businesses must implement measures such as risk management systems, regular risk analyses, preventive actions, complaints mechanisms, and annual reporting.

This is the third in a six-part blog series on getting started with third-party risk management. In this blog post, we will discuss the third-party- and contract catalogue. An essential element in TPRM and a prerequisite for gaining control over your third-party relations.

This is the second in a six-part blog series on getting started with third-party risk management. In this blog post, we will discuss the internal & external requirements that you have to take in consideration for your TPRM efforts. It is essential to start with identifying the relevant requirements as these will be the input for the next steps.

This is the first in a six-part blog series on getting started with third-party risk management. We will first start with a definition of third-parties, a short summary of reasons why organisations are ramping up their TPRM capabilities (and why you should also do that), after that we will explore the key elements of any TPRM capability program.