Name: DORA, NIS2, and Third-Party Risk: Where EU Vendor Controls Break Down
Uploaded: 2026-05-12T14:46:12.195Z
Duration: 28 min 1 s
Description: DORA, NIS2, and Third-Party Risk: Where EU Vendor Controls Break Down

Transcript for "DORA, NIS2, and Third-Party Risk: Where EU Vendor Controls Break Down": Hello, and welcome everyone to this Mitratech webinar. This is another event in the it's all GURK to me series. I'm very much looking forward to hearing from you also during this session, but first, we will hear who is our special guest today. As you know, we'll be discussing, of course, the specifics around Dora, NIST two, third party risk, and then, eventually, where do the European Union vendor controls actually break down and how they break down. And we have a special guest with us today, and that is Gil. Gil, Could you please introduce yourself first? Hi, Ian and, thanks again for the invitation, and hello to everybody else who's joining in on the call. So, special I'm not quite sure how special we are. Gail. I think in the space of GIRK, you know, it's always debatable in terms of who's more special than the than the other. So, let's see how the conversation goes. In terms of my professional background, I'm a lawyer by trade, that was my first career. But then I spent about twenty five years in financial services and worked in some quite significant, tech projects, also helping certain banks with the, EBA, third party, resilience, and the rest. Done some gigs in travel tech as well. And for the last ten years or so, on and off, I've been training, some amazing leaders across Europe, Far East, including Singapore as well. So, that's more or less who I am, but, I'm sure as we continue the conversation, you know, our listeners will get a better sense. Yeah. Thank you so much, Gail, for being with us today. My name is Jan Staupers. Maybe you've seen me on previous events. I'm doing quite a lot of them for Mitratech. I'm a lawyer by training. I've been in the GRC space for more than a decade. And what I'm doing is trying to keep track of all those regulatory developments out there and then zooming in on best practices that we're then sharing with you and our customers. So let's not, talk more about ourselves. Let's talk about content, and we can see it on the next slide, please, what we're going to discuss today in-depth. In between, there's a poll, to warm you up a little bit. Why are so many organizations compliant on paper? I guess that is that is true. You don't have to admit, but still exposed in practice. We would love to hear from you what you think the actual answer is. As those answers are coming in, we have another poll question. How do you actually measure the value of third party risk management beyond, we avoided a fine? Can you do better than that? We'd also love to hear from you on that second question. So then we have these topics, to cover with Gail. If I say, we'd love to hear from you. We, of course, have the q and a open, so if you want to reach out to us, we'd love to hear from you. But now, Gail, your view on these topics. Imagine that you're an organization, you're listening in to this webinar, and you would love to hear from, experts like yourself. What are some best practices? What are typical challenges? Where to start? What would you advise the audience to start with? Yeah, and I think the beginning is starting with why okay. So we're having this conversation. Looking at these aspects of resilience through the lens of Dora or Niece too. We can also look at the same issue from different lenses, and what I'm trying to say about that is we are in fact addressing the same issue of operational resilience. In some cases, you know, you can call it sustainability, you can call it a survival. But what really echoes a lot with people that I work with is that term resilience, building stronger organizations. So whether we look at that particular topic from the viewpoint of DORA, NEICE two, GDPR, AI Act, and all the many other pieces of regulation that we have out there. The core of it is resilience. So if we start our conversation from that point, I think we have a better opportunity to engage with more stakeholders and also to encourage more collaboration as opposed to having the conversation from a regulatory compliance perspective. Now, you know, like yourself, I'm a lawyer or I used to be a lawyer, and I've been working in the GRC space for many years as well in different organizations, in organizations that have been at different levels of maturity. And I've seen how the choice of wording really changes, the commitment and the, and the execution. So if we come at this conversation from the perspective of, oh, we have two new pieces of regulation to comply with. Well, I think we're missing an opportunity. I think we're missing an opportunity to say that this is about strengthening our own organizations. This is about resilience. And also, this is an opportunity to look at what we already have and looking at our capabilities that we've built over many years. You know, I was around for the 2,008 working in banking, so you can imagine what that was like. But as a result of that, organizations have become more resilient. The conversation has changed. And again, we, you know, every few years, we have these big, these big challenges that we deal with. But we, as organizations, we've created capabilities already. Maybe we are missing the opportunity of reframing them when speaking about Dora, Niece, etcetera. So I would start with that, you know, the way we frame the conversation, firstly. Yeah. Thank you. And when you start with that, what are typical findings? Are are organizations actually ready to even start with that first question, or or is that already a challenge for them to answer? Do do they know actually where to start, how to start? Good question. Some organizations, yes, and others not. And that is also quite normal. You know, every organization goes through its own path. We have organizations that are going through mergers acquisitions downsizing Upside listing delisting. You know those are variables that really shift the organization's focus. So, you know, quick answer to that, there's a bit of both. But what but what I do find, and I see this very much on all the training that I'm delivering to, both individuals in the public and private sector, You know, some of these individuals come from, from government ministries, you know, regulators as well. And what I do see from those conversations is that more people are talking about resilience, more so than I've noticed before. And that's really reassuring because, you know, as mentioned before, if we start the conversation from that perspective, through that lens of building stronger organizations, we we group people together. So you might find that one particular area or business unit might be lagging behind in their risk controls, etcetera. But when we start talking about what can we do to strengthen what you do, how what can we do to strengthen your delivery, you know, the conversation changes. So I think that's a real opportunity to drive these aspects. And as a result, we, you know, we meet regulation, of course, but, we also build stronger organizations and people feel empowered by that. Yeah. That makes sense. Gail, shall we ask, our people behind the screens to, put up the poll? It already happened. The poll questions. The the answers to those. You see that around 50, of the audience stated that they they feel third party risk management is underestimated. Is that an encouraging, answer, or is it worrying? How do you see that? I think it's a realistic answer. I think it's extremely realistic it. It reflects what you know what I'm hearing from from you know the different organizations I engage with. And it's you know, it's underestimated because it's complex. You know, how far do we take it? I think one of the questions that we've that we have in in the in the heading is, you know, do we know we might know our vendors, but do we know our vendors' vendors? And how far do we take that? And again, you know, coming back to this idea of resilience, and, yes, you know, resilience is the r in Dora, which is a good thing. Coming back to that is understanding the resilience of what? Okay. So the the resilience of our relationships with different third parties. How strong are those relationships? But which third parties are in scope and which are out of scope? We have some guidelines, of course, and regulatory requirements, that define that in terms of criticality. But often it is your smaller vendors, your smaller relationships that might fall out of that visibility circle because they're not deemed to be critical for, you know, conventional reasons, that that's where, you know, that's where the danger resides. So, yes, it makes sense. It's, you know, it's underestimated. I would also say from a more positive perspective, it's underestimated from a value perspective as well. You know, seeing relationships and resilience as a value add. Seeing these initiatives around the premises of Dora and NICE and related regulation. Seeing them in in that light of resilience and building value. So when we look at the value chain of our organizations, you know, that's truly when we start understanding how extensive, our relationships are. And that's a good thing. You know, that that that's a good thing to understand where our relationships reside and the value of those relationships. What I always like doing is, you know, playing with words. So if you look at the r in risk, it's it's also about relationship. It's about resilience, and just kind of, you know, building some some some interest and, and energy around that. But, yes, that that answer definitely, you know, again, resonates with, with what we're seeing. And and I expect if we could just go back to the poll one for a second, I expect that actually various organizations or people answering would think well, yes, third party risk management is underestimated but simultaneously, no one owns the full picture and simultaneously policy exists but practice does not. Is do do you think that actually this poll is a little bit tricky and people feel like they should have been able to answer more options The choose problem options. they're probably more options, but I think these three are the are the usual suspects. Okay. So those are the usual suspects in every organization is different, but these are the three that typically come up. You know, maybe less so the last one in terms of you know it's it's in paper but not in practice. I think many organizations at least the ones that that I've been exposed to, you know, there's the the quite a big move has been made to, practical implementation, you know, paper based compliance, You know that that doesn't really get you very far and I think, our our leadership teams have have have realized that. But certainly the second one, you know, lack of, you know, who actually owns it. That's definitely an issue. And, you know, that's because of the way organizations are set up. We have specialized units. You might have a specialized risk department or specialized IT security team. You know, that's common. Then you have procurement. Okay. Then you have compliance. Then you have business and probably a few more. You know, if you had more time, we could map those out. But those are typically the top level areas that are involved. And there will always be challenges around coordination and collaboration and that distinction between who owns it, you know, who's responsible, who's accountable. And when we talk about who owns it and who's responsible and and accountable, we should never forget the need to support these individuals as well from an organization's perspective, ensure that they're supported with the right tools, for one, the right skills and the right knowledge. So those can also be, you know, in a sense, root causes as to why we have challenges, relating to ownership. And, you know, as the as the line goes, who owns compliance? Well, everyone does. Who owns risk? Everyone does. But we all know that from an operational perspective, we need to unpack that. We need to define roles and responsibilities, you know, you need to look at the classic RACI matrix and see how blurred that could often be. And and that again is is continuous improvement, you know, the work in this area is never really done. Yeah. Yeah. And there, thank you so much, audience, for questions coming in. I wanted to, briefly address, the last one that we received and then hopefully, the earlier ones we can also, address. Do you think that there should be actually a person or a team responsible for the overall third party risk management process because it comes back in so many aspects. Is that reasonable? Or is the risk of that that other people when there's such a team think, okay. It's not my responsibility anymore. It's their responsibility. What so short because otherwise, we run out of time. What what are your what is your view on this scale? You know, from a purely regulatory perspective, if we look at NICE two, I think it's article 20, that refers to, the responsibilities of the board. Okay? So that principle of who's responsible, who's who, who takes ownership, that's defined at a very senior level, and that's good. You know, the typical tone from the top without that, it's very difficult to get these initiatives, you know, across the across the finishing line. So we have that regulatory support in terms of saying this is a board level responsibility. And, by the way, you could also be liable for infringements. So that, you know, kind of encourages commitment and ownership. But having said that, that needs to be distilled throughout the organization through setting up, you know, committee structures, through empowering, you know, various other individuals to actually get the job done and ensuring that there's coordination. If we don't define ownership correctly and responsibility, we have what is, you know, known as SEP, somebody else's problem. For those of you Hitchhiker Hitchhiker's Guide to the Galaxy fans, that will resonate. But that idea of, well, it's that guy or that person's responsible, you know, and we and we walk away. So that's a constant challenge, and there's no quick fixes. Okay? I I can't give a, you know, a quick fix to this. It's it's very much dependent on the organization. But we do have the regulatory. commitment there. That's good. It means that we can stop the debate. There's a regulatory requirement. But how do we operationalize it in our organization as well? That's the challenging part. Yeah. I think that was a non satisfying answer, but the the only correct one indeed. Thank you. If we look at the next topic, we have ten minutes left for this, for this webinar. What does it take to truly operationalize third party risk? And here are a couple of, aspects to it. Could you walk the audience through these, bullet points, please? Okay. First one, value chain. And I deliberately, you know, use the word value chain. Value is about relationship. It's about understanding, you know, the complete value chain of the organization. So, yes, again, you know, that's embedded in our regulatory requirements. But as practitioners, we need to know how to operationalize that. So how do we understand? I mean, understanding is knowing, asking questions. Who's my vendor? Who's the vendor's vendor? That age old principle of due diligence, risk management, knowing. Okay? So So we can't understand if we don't know, if we haven't identified those business partners. And again, I deliberately call them partners. It's about building stronger relationships as well. And value, I mean, it depends on how the organization defines value. In capitalist societies, typically value is based on money, isn't it? So follow the money. That will give you a pretty good hint as to where your value is, to be of course, it's organizationally based. So that's what I mean by, you know, the value chain and the complete value chain. Second point, you know, in the interest of time, connecting GRC data to real business to the real business context. Again, getting data that links, the message to your strategic objectives. We so often talk about KPIs, KRIs, but we don't give enough context to that data. So link that to your strategic objectives, link it to your value again. So those are some, you know, practical suggestions and, areas that I could, that I could mention. Cross functional ownership, I think it ties into the comments I made earlier, guarding against the SEP, also, supporting people in their particular positions. We can't insist on ownership if we're not offering support. And I close off with test, test, and test again. Of course, you know, we need to guard against analysis paralysis and all of that. That's self explanatory, but never underestimate the value of testing. Could be a simulation exercise. You know, I've I've had, interesting and extremely insightful experiences, you know, by running a simulation exercise with senior leaders. It builds confidence. It builds teamwork. It builds collaboration. And, also, you know, if you're lucky, it gives you a better night's sleep. Yeah. If if we look at, some of the aspects in practice, of telling how mature you are, how resilient you are as an organization, I think there's an excellent question from the audience. How do you actually measure the level of resilience? Could could you look into that, please? Now that's a tough question, especially for the end of our webinar. We might need to arrange an entire session on that. A conference. Yeah. How do you measure resilience? Well, in I would say in how you respond to challenging circumstances. Often, it's not a question of if there will be challenges if there would be a, you know a failure in your third party vendor network, but rather when so. The way to measure resilience is what are your confidence levels backed up with evidence in terms of how have you managed these challenges in the past and if we you know, look at the framing of the question we have we can locate different data points that give us a sense as to whether our organizations are resilient or not. And of course, going back to the COVID pandemic, that's a very good data point, assessing how our organizations coped with that. And of course the current geopolitical uncertainties, is another reflection point. So how resilient are we? What are our capabilities as an organization? And many organizations have that history. The possibility is that we're not leveraging that opportunity to get that data and to actually, you know, kind of build excitement and confidence around it. Yeah. If we look at a different question that we received from the audience, again, one that we could do a conference on actually, but one that comes up very, very often, how should companies distinguish between critical and noncritical vendors from a DORA slash NIST two perspective. I believe that actually if you read the letter, the spirit of the law, this is up to the organizations themselves, because it very much depends on their own particular circumstance. What what do you advise, companies that you work with when they ask you that question? Because I don't think there is a list of critical, noncritical. It very much depends on the context. How do you how do you advise them to go forward? Agree, Jan. It's very organizational dependent, but that is a call to action, to understand our organizations better. And again, there are many lenses that we can understand our organization through, but one lens that has always helped me in the work that I've done is understanding where the money is. It sounds primitive, it sounds simple, but that's really what, you know, you know, what is a fantastic marker of of of value and impact and criticality. And then secondly, understand your systems, get a systems infrastructure map, make sure that it's not just your internal systems, but understand, you know, the extent of file exchanges with your vendors. I had the privilege of being a part of a transformation team setting up an online bank in Spain in Portugal a few years ago, and testing all those different file transfers, you know, through, you know, I think we had about 16 or 17 vendors that we worked through to set up that end to end online bank. When you get to that level of detail, you truly understand criticality. And some small file with a bit of information that doesn't get pumped through, you know, the file flow, can bring the entire operation down. So to sum up, I would say, sounds primitive, but follow the money. Okay? Where are you making money? That's where your criticality is. And then, of course, your systems and data infrastructure. And then I would add to that, don't forget to make everything auditable. So, maintain that audit trail because eventually what regulators want, authorities want, is to know why you acted or did not act in a certain way. You must be able to explain that. So please don't just do it, but also maintain, those that audit trail. Yeah. And that is so was passed out because that relates to scrutiny. You know, so scrutiny, when I say that word, I think about a magnifying glass or in modern day, we take our fingers and we kind of expand, you know, being able to withstand scrutiny because there is no perfection. We will get it wrong. That's a guarantee, Yeah. okay, but we need to be able to explain our process and exactly how we, how we follow the the the process of assessing criticality, how we identified controls, how we tested them, etcetera, etcetera. So thank you very much for mentioning that, that's a definite. Yeah. Thank you. Well, on that soberingencouraging note, we're going to end this webinar only thirty minutes because that's our secret, success formula. But, of course, we are here from you, we are here for you, we would love to hear from you. We are very eager to connect you with Gail. If you have any further questions, we would love to show you how our software solutions can help you comply, manage risk, etcetera etcetera. Bottom line, let's stay in touch. Gail, thank you so much for your time today. This was very, spontaneous, very non prepared because we had some technical issues, but I don't think anyone noticed them. So really well done. Thanks again for your time. Thanks for being with us. And, dear audience, very much looking forward to welcoming you at our next webinar. Thank you. Have a nice day. Bye bye. Thank you. Bye bye.