Third-party risk: what your outsourcing provider must be able to demonstrate on security

When you give a third party access to your tools, files or customers, you don’t delegate responsibility: you add a link to your risk chain. Recent European frameworks — NIS2 for essential and important entities, DORA for the financial sector — require those in scope to oversee their providers, and these requirements flow down by contract to suppliers, including the smallest (Bitsight, NXL Forge).

Before signing: due diligence

Third-party risk guides converge on a sequence: assess the risk, qualify the provider, contract, monitor over time, and plan the exit. For an SME choosing an outsourcing provider, this translates into simple checks:

• Identity and soundness: verifiable legal existence, registration number, address, references.
• Written security policy: who owns it, when it was last reviewed.
• Access to your data: by what means (VPN, multi-factor authentication, secure workstations), with what rights, until when.
• Confidentiality: written commitments from the people involved, training, procedures on departure.
• Continuity: what happens if the dedicated person is unavailable? Is a replacement time guaranteed?
• The provider’s subcontractors: who are they, where do they operate?

The clauses that matter

Contracts benefit from specifying: security obligations, incident notification within a defined time, an audit right (at least on documents), data location, treatment at contract end (return, deletion, proof) and allocation of responsibilities. The absence of these clauses is often the first sign of an immature provider.

During the contract: monitor

A check at signing isn’t enough. Plan a periodic review — annual, or after any notable change: new tool, new subcontractor, incident. Check the list of active accesses and remove those no longer needed. An account forgotten after someone leaves is an open door.

Warning signs

• A provider unable to say where your data is.
• Access shared among several people under a single login.
• No incident procedure, or an answer along the lines of "it has never happened to us".
• A refusal of any verification, even on documents.

Our approach

At Workynet, the baseline guarantees are those described on our Compliance page: confidentiality training, a secure environment (VPN, CRM/ERP), replacement of a collaborator within 72 hours and regular audits. We invite you to verify them rather than take our word for it — which is exactly the approach this article recommends.

Sources

• Bitsight — Guide to global third-party risk regulations in 2026
• NXL Forge — NIS2 and SMEs: the subcontracting cascade (in French)
• UpGuard — Third-party risk management guide