Your vendors run on the same few cloud and ICT providers. What DORA, NIS2 and GDPR expect you to know about who sits behind them.
Ten vendors, one cloud region
A procurement team reviews ten SaaS vendors over a year. Each one passes: contract clauses in place, a SOC 2 report on file, a DPA with a sub-processor list. Then one hosting provider has a regional outage and seven of the ten stop working at the same time.
None of those reviews was wrong. They simply looked at each vendor on its own. The risk sat one level further down, in the providers the vendors themselves depend on. That is fourth-party risk, and regulators now expect you to see it.
What is fourth-party risk?
Your third parties are the companies you contract with. Your fourth parties are the companies they rely on to deliver that service to you: cloud hosting, data centres, payment processors, model providers, managed security services.
You usually have no contract with a fourth party. You can't audit it directly, and it may not know you exist. What you can control is what your direct vendor tells you about it, what the contract lets you do when it changes, and how many of your critical services end up depending on the same one.
Who are the 19 critical ICT third-party providers?
DORA, Regulation (EU) 2022/2554, created an EU oversight framework for ICT providers that the financial sector depends on. Under Article 31, the European Supervisory Authorities (EBA, EIOPA and ESMA) designate providers as critical, and each one gets a Lead Overseer with powers to request information, run inspections and issue recommendations.
In November 2025 the ESAs published the first list of designated critical ICT third-party providers: 19 companies, made up largely of the major cloud platforms and large technology, data and infrastructure providers. Oversight of those providers sits with the regulators. It does not replace your own duties as a customer, direct or indirect, of those providers.
What does DORA ask you to do about concentration?
Article 29 requires a financial entity, before it signs an ICT contract supporting a critical or important function, to assess whether the arrangement adds to ICT concentration risk: for example, contracting with a provider that is not easily substitutable, or with several providers that are closely connected.
Article 29(2) goes further for subcontracting. Where the contract allows the provider to subcontract ICT services supporting a critical or important function, you have to weigh the benefits and risks of that subcontracting, especially when the subcontractor is outside the EU. In other words, the assessment is expected to look past your direct vendor.
What do the subcontracting rules add?
Commission Delegated Regulation (EU) 2025/532 sets out what you must check when an ICT service supporting a critical or important function may be subcontracted. Before signing, you assess the provider's ability to select and monitor its subcontractors, and the contract has to set out the conditions for subcontracting, the monitoring of the chain, and what happens when the provider wants to make a material change to it.
The practical effect: a vendor that subcontracts parts of a critical service needs to tell you who does what, and to give you notice and the chance to object, or to terminate, when that changes. DORA's register of information already asks you to record the ICT subcontractors that effectively underpin services supporting critical or important functions.
Does this only matter for financial entities?
No. NIS2, Directive (EU) 2022/2555, requires essential and important entities to manage supply chain security under Article 21(2)(d), and Article 21(3) asks them to take into account the vulnerabilities specific to each direct supplier and service provider. GDPR Article 28(2) and 28(4) require a processor to get authorisation before engaging another processor and to pass the same data protection obligations down the chain.
Our earlier post, NIS2 asks about your suppliers. Your customers are asking about you, covers how those duties turn into questionnaires. Fourth-party questions are where those questionnaires are heading next.
Where is the evidence already sitting?
You don't need a new data source to start. Two documents most vendors already provide describe the chain:
- The GDPR sub-processor list (in the DPA annex or a public page): who processes personal data on the vendor's behalf, for what, and where.
- The SOC 2 report's description of subservice organisations: which providers the vendor relies on, and whether their controls were carved out of the audit or included in it.
- The vendor's subcontracting clause: whether subcontracting is allowed for the services you rely on, under what conditions, and with what notice.
- The vendor's business continuity and exit documentation: what happens if a key provider fails or has to be replaced.
How to read the chain across vendors
Collect the providers named in those documents for every vendor that supports a critical or important function, and put them in one list. Then look for the same names appearing again and again. If most of your critical vendors depend on one hosting provider or one region, that is a concentration you need to record, assess and plan for, even though you have no contract with that provider.
A SOC 2 report that uses the carve-out method deserves a second look: the subservice organisation's controls were not tested in that report, so you need its own assurance report or another source of evidence.
What to prepare if you are the vendor being assessed
- A current list of subcontractors and sub-processors for each service, with their role and location.
- A clear subcontracting clause and a change notification process with a notice period your customers can act on.
- The subservice organisation section of your SOC 2 report, and the assurance reports you rely on for carved-out providers.
- A short statement on your own dependency on major cloud providers and how you would recover or move if one failed.
See how a review links findings to the document
The ProcureCortex demo at procurecortex.com/explore (self-serve: email sign-in link, no sales call) shows vendor reviews where each finding points to the document and clause it came from. All vendors and findings in the demo are sample data, and the demo labels findings against SOC 2, ISO 27001, GDPR and contract clauses; mapping them to DORA or NIS2 is your own team's analysis.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 28 to 31: https://eur-lex.europa.eu/eli/reg/2022/2554/oj
- Commission Delegated Regulation (EU) 2025/532 on subcontracting ICT services supporting critical or important functions: https://eur-lex.europa.eu/eli/reg_del/2025/532/oj
- EIOPA, Digital Operational Resilience Act (DORA) and oversight of critical ICT third-party providers: https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en
- Directive (EU) 2022/2555 (NIS2), Article 21: https://eur-lex.europa.eu/eli/dir/2022/2555/oj
- Regulation (EU) 2016/679 (GDPR), Article 28: https://eur-lex.europa.eu/eli/reg/2016/679/oj
Get the vendor review guide
One email a month with a worked example like this one. Nothing else.