ICT Third-Party Risk Management
Do you really know the risk your suppliers expose you to?
Managing the cyber risk introduced by your suppliers
Organisations increasingly rely on critical digital suppliers such as managed service providers, cloud vendors, SaaS editors and IT subcontractors. However, visibility into their actual cyber exposure often remains partial, declarative or point-in-time.
We run this as a managed, ongoing service, not a one-off audit: Stroople monitors your critical ICT suppliers on your behalf, continuously, so a supplier incident doesn’t become your own crisis.
In a strengthened regulatory context (DORA, NIS2), this lack of control can turn a supplier incident into a systemic risk for the organisation. Software supply chain attacks accounted for 10.6% of the incidents analysed in ENISA’s 2025 Threat Landscape report.
An operational approach to control critical dependencies
This offering enables organisations to manage the real cyber risk introduced by their ICT third parties, based on observable facts rather than self-declared maturity.
An external exposure score tells you how well-defended a supplier’s own perimeter is, not how much access they have to your systems, or how dependent your operations are on them. A supplier with an excellent score can still carry a critical business risk if it holds broad administrative access or supports a function you cannot easily replace. We read exposure and business criticality together, not one instead of the other.
It addresses a simple question: is a supplier exposed, vulnerable or already compromised, and what decisions should follow?
01
Critical supplier identification
We identify which suppliers are truly critical, based on dependency, data sensitivity and potential impact, not a flat list of every vendor.
02
Attack surface monitoring
Continuous external exposure analysis of your suppliers, powered by our EASM partner Scovery.
03
Leak and dark web detection
Ongoing monitoring for data leaks and compromise indicators, powered by our threat intelligence partner Flare.
04
Targeted technical assessment
Focused testing, including penetration testing, on the suppliers and functions that carry the most risk.
05
Contractual security
Assessment results translated into stronger contracts: security clauses, audit rights, and DORA/NIS2-aligned safeguards.
06
Continuous governance
Corrective action plans tracked over time, with clear visibility on progress and risk reduction.
Securing contractual commitments
Assessment results are used to strengthen contractual arrangements with suppliers: security clauses, audit rights, and for suppliers supporting critical or important functions, the safeguards DORA requires under Articles 28 to 44, including subcontractor oversight and exit provisions. For organisations under NIS2, this also covers the supply chain security obligations of Article 21(2)(d).
How you engage
Your starting point determines how we work together.
- Advisory — We assess your current third-party risk maturity and design the framework, methodology and criteria your organisation needs, so your teams can run it internally.
- Deployment — We implement the methodology, tools and processes for you, then hand over a working programme your teams operate on their own.
- Managed delegation — We run the entire monitoring and governance cycle on your behalf, on an ongoing basis, reporting results and recommendations directly to you.
Action plan monitoring and ongoing governance
Corrective action plans are monitored over time, providing clear visibility on progress, effectiveness and impact on overall risk.
This continuous steering embeds ICT third-party risk management into a sustainable and demonstrable governance framework.
Identify
Assess
Secure
Monitor
Questions
Frequently Asked Questions
General questions about ICT Third-Party Risk Management
ICT third-party risk management is the ongoing identification, assessment and monitoring of the cybersecurity risk introduced by an organisation’s suppliers, cloud providers and IT subcontractors, so that a supplier incident doesn’t become the organisation’s own crisis.
It’s an ongoing, managed service. Stroople monitors your critical suppliers continuously and reports on their risk posture over time, rather than delivering a single point-in-time assessment.
Questionnaires rely on what a supplier declares about itself. We assess suppliers against observable, factual indicators, external attack surface exposure, data leak detection, targeted technical testing, so exposure is identified regardless of what a supplier states in a self-assessment.
DORA’s Articles 28 to 44 require financial entities to manage the risk of critical ICT third-party providers, including contractual safeguards, audit rights and exit strategies. NIS2 requires essential and important entities to manage supply chain security under Article 21(2)(d). Our assessments and monitoring feed directly into both obligations.