Regulators now hold organisations accountable for their suppliers' security, and a growing number regulate the largest suppliers directly. DORA, NIS2, GDPR, the US banking agencies, the FTC, NYDFS, HIPAA, the SEC, APRA, OSFI, MAS and the UK Prudential Regulation Authority all set third-party expectations, but they differ on what must be in the contract, what goes in a register, when the regulator must be told about a new arrangement and how fast a supplier must report an incident. This map lays those rules out side by side for the major economies, then shows where they agree, where they conflict, and what that means for supplier access through API keys, OAuth tokens and service accounts. It is for TPRM leads, procurement and legal teams, CISOs and auditors. Status as of 11 November 2026.
Source note: this map summarises official texts, regulator guidance and the sources listed at the end, with status as of 11 November 2026. It is not legal advice. Confirm against the official text before relying on it.
Key takeaways
- Accountability never transfers. Every regime in this map keeps responsibility with the regulated firm, whatever the contract says; the US interagency guidance, DORA and APRA CPS 230 say so explicitly.
- Registers are becoming regulatory returns. DORA's register of information, APRA's material service provider register (first due 1 October 2025) and MAS outsourcing registers are submitted to supervisors, not just kept for audit.
- Contract clauses are prescribed. GDPR Article 28(3), DORA Article 30, HIPAA business associate provisions and the FTC Safeguards Rule all list terms the contract must contain.
- The largest suppliers are now supervised directly. The EU oversees critical ICT third-party providers under DORA, and the UK designated four cloud providers as critical third parties from 13 July 2026.
- Supplier access is identity access. Most supplier compromises reach customers through credentials the customer issued: API keys, OAuth grants and service accounts, which regulators expect you to inventory, limit and revoke on exit.
Regulations and frameworks at a glance
| Rule | Who it applies to | Core third-party obligations | Status (11 November 2026) |
|---|---|---|---|
| EU DORA, Regulation (EU) 2022/2554, Articles 28 to 44 | EU financial entities; critical ICT third-party providers (CTPPs) | ICT third-party risk strategy, register of information on all ICT contracts, pre-contract assessment, concentration risk, mandatory contract terms (Article 30), exit strategies; direct oversight of designated CTPPs | Applies since 17 January 2025 |
| EU NIS2, Directive (EU) 2022/2555, Article 21(2)(d) and 21(3) | Essential and important entities | Supply chain security, including security aspects of relationships with direct suppliers and service providers, accounting for each supplier's vulnerabilities and secure development practices | Applies via national law |
| GDPR and UK GDPR, Article 28 | Controllers using processors | Use only processors giving sufficient guarantees; prior authorisation for sub-processors; contract terms (a) to (h) including Article 32 security, assistance with breaches, deletion or return, audits | In force |
| EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) | EU banks, investment firms, payment and e-money institutions | Outsourcing register, critical or important function assessment, due diligence, contract and exit terms | Applies since 30 September 2019, alongside DORA for ICT |
| UK PRA SS2/21 Outsourcing and third party risk management | UK banks, building societies, PRA-designated investment firms, Solvency II insurers, third-country branches | Applies and extends the EBA guidelines, with expanded data security and business continuity and exit plan expectations | Current version effective 31 December 2024; revised version effective 18 March 2027 |
| UK critical third parties regime (FSMA 2000 as amended) | Third parties designated by HM Treasury | Regulators' rules on managing risks to systemic services and communication with regulators and firms during incidents | Rules published November 2024; first four designations effective 13 July 2026 |
| US Interagency Guidance on Third-Party Relationships | Banking organisations supervised by the Federal Reserve, FDIC and OCC | Risk-based life cycle: planning, due diligence and selection, contract negotiation, ongoing monitoring, termination; oversight and accountability throughout | Final 6 June 2023; supervisory guidance, "does not impose any new requirements" |
| US FTC Safeguards Rule, 16 CFR 314.4(f) | Non-bank financial institutions under FTC jurisdiction | Select capable providers, require safeguards by contract, periodically reassess by risk | In force |
| New York 23 NYCRR 500.11 | DFS-licensed covered entities | Third-party service provider security policy: identification and risk assessment, minimum practices, due diligence, periodic assessment, guidelines on access controls, encryption and incident notice | In force |
| US HIPAA, 45 CFR 164.308(b) and 164.502(e) | Covered entities and business associates | Business associate agreements: permitted uses, safeguards under the Security Rule, reporting of security incidents and breaches, flow-down to subcontractors, return or destruction | In force |
| US SEC Regulation S-P amendments | Broker-dealers, investment companies, registered advisers, transfer agents | Service provider oversight in the incident response programme; customer notice no later than 30 days after becoming aware | Adopted 16 May 2024; compliance required from 3 December 2025 (larger entities) and 3 June 2026 (smaller entities) |
| Australia APRA CPS 230 | APRA-regulated banks, insurers and superannuation trustees | Material service provider policy and register, notification of new or changed material arrangements and offshoring, contract requirements | Applies since 1 July 2025; amendments from 1 July 2026; pre-existing contracts by the earlier of renewal or 1 July 2026 |
| Canada OSFI Guideline B-10 | Federally regulated financial institutions | Six outcomes; inventory by risk and criticality, subcontractor oversight, cloud portability and concentration, prompt incident notice from third parties | Published April 2023; effective 1 May 2024 |
| Singapore MAS Guidelines on Outsourcing (Banks) and Notice 658 | Banks and merchant banks in Singapore | Management of ongoing outsourced relevant services; separate guidelines for non-banks | Guidelines effective 11 December 2024 |
Industry standards sit alongside: PCI DSS Requirement 12.8 for service providers that touch cardholder data, NIST SP 800-161 Rev. 1 for federal supply chain risk, and ISO/IEC 27036 for supplier relationships. For the evidence suppliers hand over, see the Third-Party Attestation Comparison Map.
Scope: which suppliers are in scope
The rules use different tests to decide which relationships need full treatment, and a single supplier can be in scope under several at once.
| Test | Rules | What it captures |
|---|---|---|
| All ICT services | DORA (register of information covers all ICT contracts) | Every software, cloud and data service, with heavier rules where they support critical or important functions |
| Critical or important function | DORA, EBA guidelines, PRA SS2/21 | Services whose failure would materially impair performance, compliance or continuity |
| Material arrangement or service provider | APRA CPS 230, MAS (material outsourcing) | Providers of critical operations or that expose the entity to material operational risk |
| Access to protected data | GDPR Article 28, HIPAA, FTC Safeguards, NYDFS 500.11, Reg S-P | Any processor, business associate or service provider that receives or can access personal, health, customer or nonpublic information |
| Supplier to the entity's network and information systems | NIS2 Article 21(2)(d) | Direct suppliers and service providers, including managed services and software |
| Systemic importance | DORA CTPP oversight, UK CTP regime | Providers whose failure could affect financial stability across many firms |
Data-access tests catch suppliers that tiering by spend misses: a small SaaS integration with an OAuth grant into your CRM is a processor under GDPR and a third-party service provider under NYDFS. See the Third-Party Risk Management Guide.
Key obligations compared
Contract terms
| Clause | Required or expected by |
|---|---|
| Security measures the supplier must maintain | GDPR 28(3)(c), DORA Art. 30, HIPAA BAA, FTC 314.4(f), NYDFS 500.11 |
| Incident and breach notice to you | HIPAA BAA, DORA Art. 30, NYDFS 500.11, OSFI B-10, GDPR 28(3)(f) with Art. 33(2) |
| Audit, access and inspection rights | GDPR 28(3)(h), DORA Art. 30, EBA guidelines, PRA SS2/21, OSFI B-10 |
| Sub-contractor approval and flow-down | GDPR 28(2) and 28(4), HIPAA (subcontractor BAAs), OSFI B-10, DORA |
| Data location and processing locations | DORA Art. 30, EBA guidelines, APRA (offshoring notification) |
| Termination, exit and data return or deletion | GDPR 28(3)(g), DORA Art. 28 and 30, HIPAA BAA, PRA SS2/21 |
See the Third-Party Security Contract Clauses Template and the HIPAA Business Associate Agreements Guide.
Registers and regulator notifications
- DORA: register of information on all ICT third-party arrangements at entity, sub-consolidated and consolidated level, reported to competent authorities; inform the authority in a timely manner of planned contracts for critical or important functions. See the DORA ICT Third-Party Risk and Register of Information Guide.
- APRA CPS 230: material service provider register submitted to APRA (first submissions by 1 October 2025) and notification of new or changed material arrangements and offshoring through APRA's forms. See the APRA CPS 230 Operational Risk Management Guide.
- EBA and PRA: outsourcing register and prior notice to the supervisor of planned material or critical outsourcing.
- OSFI B-10: inventory of third parties by risk and criticality, available to OSFI on request. See the OSFI E-21 and B-10 guide.
- MAS: outsourcing register, with insurers required to submit it annually by 31 March.
Supplier incident notice
Your reporting clock usually starts when you become aware, so a supplier's delay eats your deadline. HIPAA requires business associates to report security incidents and breaches; NYDFS counts incidents at third-party service providers as reportable; Reg S-P requires service provider oversight so customers can be told within 30 days; OSFI expects prompt notice of cyber incidents, including at subcontractors. For deadlines in detail, see the Third-Party Incident Notification Requirements Guide and the Cyber Incident Reporting Requirements Map.
Direct oversight of critical providers
Two regimes now supervise suppliers themselves rather than only their customers.
| Feature | EU DORA CTPP oversight | UK critical third parties |
|---|---|---|
| Who designates | European Supervisory Authorities, using DORA Article 31 criteria | HM Treasury, generally on recommendations from the Bank of England, PRA and FCA |
| Who oversees | A Lead Overseer (EBA, EIOPA or ESMA) | Bank of England, PRA and FCA jointly |
| Designated so far | See the dedicated guide | Four cloud providers (Microsoft Ireland Operations, Google Cloud EMEA, Amazon Web Services EMEA, Oracle Corporation UK) from 13 July 2026 |
| What it means for customers | Does not reduce the financial entity's own obligations under Articles 28 to 30 | Firms remain responsible for their own operational resilience and outsourcing compliance |
See the DORA Critical ICT Third-Party Provider Oversight Guide, the UK Critical Third Parties Regime Guide and the Third-Party Concentration Risk Guide.
What it means for AI agents and non-human identities
Regulators write about suppliers; attackers use the credentials those suppliers hold. ATT&CK tracks this as T1199 Trusted Relationship. The OAuth tokens stolen from one chatbot integration in the Salesloft Drift breach opened hundreds of customer Salesforce tenants, and the Okta support system breach started with a service account credential saved in a personal profile.
| Regulatory duty | Machine identity reading |
|---|---|
| Register of arrangements (DORA, APRA, MAS) | Record each supplier's API keys, OAuth apps, service accounts and agent identities in your tenants, with scopes and owners |
| Access controls in supplier policies (NYDFS 500.11, GDPR Art. 32 via 28(3)(c)) | Least-privilege scopes, short-lived tokens, MFA or workload federation for supplier access |
| Ongoing monitoring (interagency guidance, B-10, FTC periodic reassessment) | Alert on supplier token use from new locations or at unusual volume |
| Exit and termination (DORA, GDPR, PRA) | Revoke every credential and grant on exit and verify revocation; stale supplier tokens are a common finding |
| AI vendors processing your data | Treat model providers and agent platforms as processors and ICT providers; their agents' access to your systems needs the same register entry |
See the OWASP NHI Top 10 NHI3 Vulnerable Third-Party NHI Guide, the Third-Party NHI Due Diligence Questions Guide and the Third-Party Credential Register Template.
Compliance steps
- Build one obligations matrix. For each legal entity, list the rules that apply, their scope test, register format, notification duties and mandatory clauses. Use the strictest common denominator as the default.
- Inventory suppliers and their access. Combine procurement, accounts payable, SSO, OAuth consent logs and cloud IAM to find every supplier, including free tools with data access. See the guide to inventorying third-party OAuth apps in Google Workspace.
- Tier by criticality and data access. Apply DORA critical or important function, CPS 230 material and GDPR processor tests together, and record why each supplier sits in its tier.
- Update contract templates. One clause library covering GDPR 28(3), DORA Article 30, HIPAA BAA and NYDFS 500.11 terms, with incident notice shorter than your own shortest regulatory clock.
- Pilot the register return. Produce the DORA or APRA register from your systems for one entity before the submission window, and fix data quality gaps.
- Monitor and reassess. Reassess critical suppliers at least annually, review supplier credentials quarterly and track open findings.
- Test exit. For each critical supplier, document and rehearse the exit plan, including data return and credential revocation.
Metrics that show it is working
- Register completeness: percentage of active suppliers in the register with tier, function and data access recorded.
- Contract conformance: percentage of critical and data-processing suppliers on current mandatory clauses.
- Notice terms: percentage of critical suppliers bound to notify incidents within 24 hours or less.
- Reassessment timeliness: critical suppliers reassessed within the last 12 months.
- Credential hygiene: supplier API keys and OAuth grants with an owner and an expiry, and credentials still live after contract end (target zero).
Common failure patterns
- Spend-based tiering: small, cheap SaaS tools with broad data scopes are left out of scope.
- Questionnaires instead of evidence: self-attestation accepted for critical suppliers without independent assurance or testing.
- Notice clauses longer than your clock: a supplier allowed 72 hours to tell you when you have 24 hours to tell the regulator. Change Healthcare's 2024 outage showed how a single provider's incident spreads across a sector; see the Change Healthcare breach.
- Register built by hand once a year: the submission is accurate on the day and stale a month later.
- Exit without revocation: contracts end but OAuth grants, API keys and service accounts remain active.
Framework mapping
| Theme | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal and regulatory requirements understood | GV.OC-03 | PM-9 | 5.31 |
| Suppliers known and prioritised by criticality | GV.SC-04 | SR-3 | 5.19 |
| Requirements in supplier contracts | GV.SC-05 | SA-4, SA-9 | 5.20 |
| Due diligence before engagement | GV.SC-06 | SR-6 | 5.21 |
| Ongoing supplier risk monitoring | GV.SC-07 | SR-6 | 5.22 |
Practitioner checklist
- Keep an obligations matrix per legal entity covering scope tests, registers, notifications and clauses.
- Find suppliers through SSO, OAuth consent and cloud IAM logs, not procurement records alone.
- Tier suppliers by function criticality and data access, with the rationale recorded.
- Use one clause library meeting GDPR 28(3), DORA Article 30, HIPAA and NYDFS 500.11.
- Require incident notice from suppliers faster than your shortest regulatory deadline.
- Generate register returns from systems of record and test them before the window opens.
- Review supplier credentials quarterly and revoke them on exit.
- Track direct oversight regimes (DORA CTPPs, UK CTPs) for your critical providers.
Standards and references
- EUR-Lex: Regulation (EU) 2022/2554 (DORA)
- GDPR: Article 28 Processor
- Federal Register: Interagency Guidance on Third-Party Relationships: Risk Management
- eCFR: 16 CFR 314.4 Elements of the FTC Safeguards Rule
- Bank of England: SS2/21 Outsourcing and third party risk management
- APRA: Operational risk management (CPS 230)
- OSFI: Guideline B-10 Third-Party Risk Management
- HHS: Business Associate Contracts
This guide summarises third-party risk regulation as of 11 November 2026 and is not legal advice. Related NHI Mgmt Group resources: Third-Party Risk Management Guide · DORA Guide · NIST SP 800-161 Cyber Supply Chain Risk Management Guide · Third-Party and Supply Chain Risk Executive Briefing