How do I evaluate TPRM platforms for my sector?

Before looking at each rule, six questions always apply. None depends on the brand of the tool, and all of them can be tested in a demo with your own data.

DORA is Regulation (EU) 2022/2554 and has applied since 17 January 2025. Article 28 makes clear that the entity stays responsible even when it outsources, requires an ICT third-party risk strategy and, in paragraph 3, a register of information on all contractual arrangements. Article 29 asks for an assessment of concentration risk, Article 30 sets minimum contract terms (with exit plans and access and audit rights for critical or important functions) and Article 31 sets up the designation of critical providers, which then fall under EU oversight.

The format of the register is set by Implementing Regulation (EU) 2024/2956.

Source: Regulation (EU) 2022/2554 (DORA), Articles 28 to 31, on EUR-Lex (opens in a new tab); Implementing Regulation (EU) 2024/2956, register of information templates, on EUR-Lex (opens in a new tab)

Directive (EU) 2022/2555 requires, in Article 21(2)(d), supply chain security measures, including the security aspects of the relationship with each direct supplier. Article 21(3) adds that you must take into account the vulnerabilities specific to each supplier and the overall quality of its products and cybersecurity practices. Article 20 makes the management body responsible for approving and overseeing those measures.

For DNS, cloud, data centre, managed service and other specific provider types, Implementing Regulation (EU) 2024/2690 adds technical requirements.

Source: Directive (EU) 2022/2555 (NIS2), Articles 20, 21 and 23, on EUR-Lex (opens in a new tab); Implementing Regulation (EU) 2024/2690, technical and methodological requirements, on EUR-Lex (opens in a new tab)

Royal Decree 311/2022 applies to the public sector and, under Article 2(3), also to the systems of private entities that provide services or solutions to a public body. In Annex II, measure op.ext.1 asks for a service level agreement before external resources are used, op.ext.2 for a routine system to measure compliance with it and op.ext.3 for protection of the supply chain.

The first two apply at medium and high category; op.ext.3 applies at high category.

Source: Royal Decree 311/2022 (ENS), Article 2 and Annex II, op.ext measures, in the BOE (Spanish) (opens in a new tab)

Under HIPAA, anyone who creates, receives, maintains or transmits protected health information on behalf of a covered entity is a business associate. The Security Rule (45 CFR 164.308(b) and 164.314(a)) lets a business associate handle ePHI only with satisfactory assurances in a contract. Sections 164.502(e) and 164.504(e) cover the same for the Privacy Rule, including the assurances the business associate must obtain from its own subcontractors.

A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery (164.410).

Source: 45 CFR 164.308(b), business associate contracts, on eCFR (opens in a new tab); 45 CFR 164.314(a), business associate contracts (Security Rule), on eCFR (opens in a new tab); 45 CFR 164.502(e), disclosures to business associates, on eCFR (opens in a new tab); 45 CFR 164.504(e), content of business associate contracts, on eCFR (opens in a new tab); 45 CFR 164.410, notification by a business associate, on eCFR (opens in a new tab)

The CMMC program is in 32 CFR Part 170. Section 170.23 requires the prime contractor to comply and to require its subcontractors to comply, with a minimum level that depends on the information they handle: Level 1 for federal contract information without CUI and at least Level 2 where there is CUI. Section 170.16(c) and 170.17(c) add that a cloud provider handling CUI must be FedRAMP Moderate authorized or meet equivalent requirements.

Source: 32 CFR 170.23, application to subcontractors, on eCFR (opens in a new tab); 32 CFR Part 170 (CMMC program), on eCFR (opens in a new tab)

The SAMA Cyber Security Framework devotes domain 3.4 to third parties, with three subdomains: 3.4.1 contract and vendor management, 3.4.2 outsourcing and 3.4.3 cloud computing. The NCA Essential Cybersecurity Controls (ECC-2:2024) include domain 4, third-party and cloud computing cybersecurity.

Source: SAMA Cyber Security Framework, domain 3.4 «Third Party Cyber Security», in the SAMA Rulebook (opens in a new tab); NCA Essential Cybersecurity Controls (ECC-2:2024), domain 4 (opens in a new tab)

There are four families and none is better in the abstract: questionnaire and evidence collection platforms, external security rating services, GRC suites with a vendor module, and integrated platforms that join supplier evidence, risk quantification and multi-framework compliance. HodeiShield belongs to the fourth, and it is one option among others.

According to its documentation, it calculates a supplier score from 0 to 100 with dependencies in a graph, blast radius and a concentration index (HHI); runs an external scan (exposed ports, CVEs, known breaches), matches supplier SBOMs (CycloneDX or SPDX) against OSV.dev and offers a portal where the supplier answers questionnaires through a single-use link, with no account. It quantifies FAIR exposure in euros with a simulated uncertainty band (uncalibrated). It measures 17 frameworks, among them NIS2, ENS, DORA, HIPAA, CMMC 2.0, SAMA CSF and Saudi ECC-1:2018, as coverage measured against its controls, not as certification.

Limits: documentary evidence is uploaded or linked, not pulled from the cloud. It generates the DORA register of information as an xBRL-CSV package, but you file it.

With two or three candidates, load the same ten real suppliers into each, including the most critical one and the one with the most subcontractors. Ask each tool to produce what your supervisor or auditor would ask for: the register, the evidence for one control and the deadline for an incident. Score with the list in the PDF and note what each one does not do.