Procedure
Fourth-Party and Nth-Party Risk Procedure
This procedure defines how the organization identifies, monitors, and escalates risk arising from suppliers beyond the direct third-party relationship: fourth-party (the supplier's supplier) and nth-party (any subsequent tier). It supports a financial entity's DORA ICT third-party risk management, limited to the Article 29(2) and Article 30(2)(a) parts named in the Framework alignment section, GDPR Article 28 sub-processor obligations, NIS 2 supply-chain security obligations, and the organization's broader supplier governance.
- Type
- Procedure
- Version
- 1.0.18
- Date
- 2026-10-29
- Owner
- Supplier Risk Maintainer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Supply Chain Governance
- Review frequency
- Annual and upon material change to the supplier ecosystem, regulatory expectation, or concentration risk posture
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Definitions
- Visibility tiers
- Identification
- Procedure steps
- Coordination with adjacent procedures
- Operating expectations
- Framework alignment
- Limitations
Frameworks it maps to
- DORA
- DORA RTS (EU) 2025/532
- GDPR / UK GDPR
- NIS 2
- NIST CSF 2.0
- NIST SP 800-161 Rev. 1
- ISO 28000:2022
- ISO/IEC 27036-3:2023
- FSB Cyber Lexicon and Third-Party Risk Toolkit
Related documents
- Supplier and Cloud Governance Frameworksupply-chain
- Supplier Security and Privacy Assurance Standardsupply-chain
- Supplier Due Diligence Proceduresupply-chain
- Supplier Ongoing Monitoring Proceduresupply-chain
- Supplier Risk Register Templatesupply-chain
- Subprocessor Register Templatesupply-chain
- Concentration Risk Registersupply-chain
- Third-Party and Supply Chain Risk Standardrisk
- DORA Implementation Annexcompliance
Next
All Documents