{"id":70334,"date":"2026-08-29T08:01:32","date_gmt":"2026-08-29T06:01:32","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/?p=70334"},"modified":"2026-09-17T14:52:03","modified_gmt":"2026-09-17T12:52:03","slug":"third-party-risk-governance-from-vendor-register-to-steering","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/","title":{"rendered":"Third-Party Risk Governance: From Vendor Register to Steering"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">Third-party risk management today requires more than a well-maintained vendor list. Supervisory authorities in the EU and Switzerland demand structured registers, a continuously updated risk assessment and regular reporting to the governing body. The first-ever designation of critical ICT third-party providers in November 2025 shows that systemic risks are now being derived from this register data. For GRC functions, this marks the shift from recording to steering, supported by metrics, defined responsibilities and escalation paths.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>Effective governance of third-party risk needs more than a vendor register: it combines structured register data on criticality and substitutability with a continuously updated risk assessment and regular reporting to the governing body. DORA, the EBA guidelines on outsourcing and FINMA supervision require this structure, because a register alone does not remedy the deficiencies in service provider management that supervisory authorities have identified.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-do-supervisory-authorities-require-\">What do supervisory authorities require beyond register maintenance?<\/a><\/li>\n<li><a href=\"#a2-what-does-the-designation-of-critical-ic\">What does the designation of critical ICT third-party providers in November 2025 show?<\/a><\/li>\n<li><a href=\"#a3-what-deficiencies-does-finma-identify-in\">What deficiencies does FINMA identify in service provider management?<\/a><\/li>\n<li><a href=\"#a4-what-structure-does-effective-governance\">What structure does effective governance of third-party risk require?<\/a><\/li>\n<li><a href=\"#a5-what-first-step-leads-from-list-to-steer\">What first step leads from list to steering?<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"rc-figures\">\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"19\">19<span class=\"unit\">providers<\/span><\/div>\n<div class=\"rc-figure-label\">Critical ICT third-party providers designated for the first time by EBA, EIOPA and ESMA under DORA<\/div>\n<div class=\"rc-figure-src\">European Banking Authority, press release, 18 November 2025<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"50\">50<span class=\"unit\">%<\/span><\/div>\n<div class=\"rc-figure-label\">Share of successful cyberattacks on service providers of financial institutions, up from around 25 percent<\/div>\n<div class=\"rc-figure-src\">FINMA, Supervisory Communication 03\/2024, 7 June 2024<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"13\">1\/3<\/div>\n<div class=\"rc-figure-label\">Share of cyberattacks reported to FINMA that occur indirectly via third parties<\/div>\n<div class=\"rc-figure-src\">FINMA Risk Monitor 2024, cited in Handelszeitung Insurance, 19 February 2025<\/div>\n<\/div>\n<\/div>\n<h2 id=\"a1-what-do-supervisory-authorities-require-\">What do supervisory authorities require beyond register maintenance?<\/h2>\n<p>Under Article 28(3) of the <a href=\"https:\/\/www.fma.gv.at\/en\/cross-sectoral-topics\/dora\/dora-managing-of-ict-third-party-risk\/\" target=\"_blank\" rel=\"noopener nofollow\">DORA Regulation<\/a>, financial entities must maintain a register of all contractual arrangements with ICT third-party providers and report it to the competent authority.<\/p>\n<p>Beyond the register, DORA requires a strategy for ICT third-party risk, due diligence assessments before the use of ICT services, and clear requirements on contract content and exit strategies. The European Banking Authority (EBA) additionally obliges institutions, in its guidelines on outsourcing published in 2019, to inform the governing body regularly about identified risks and to keep the risk assessment continuously updated. These requirements presuppose a structure that goes beyond a plain list of names: data fields on criticality, contract duration, substitutability and concentration must be maintained and evaluated.<\/p>\n<h2 id=\"a2-what-does-the-designation-of-critical-ic\">What does the designation of critical ICT third-party providers in November 2025 show?<\/h2>\n<p>On 18 November 2025, the European Supervisory Authorities EBA, EIOPA and ESMA designated 19 <a href=\"https:\/\/www.eba.europa.eu\/publications-and-media\/press-releases\/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital\" target=\"_blank\" rel=\"noopener nofollow\">critical ICT third-party providers<\/a> under DORA for the first time, deriving systemic concentration risks from reported register data.<\/p>\n<p>According to the European Insurance and Occupational Pensions Authority (EIOPA), the designation followed a multi-stage process: collection of data from the registers of financial entities, a criticality assessment based on systemic importance, the role played in critical functions and substitutability, and a right of the affected providers to be heard. For financial entities, this means that their own register data no longer serves internal oversight alone, but feeds directly into a supervisory risk analysis. The regulatory overlaps between EBA guidelines, DORA and MaRisk sharpen this requirement further.<\/p>\n<h2 id=\"a3-what-deficiencies-does-finma-identify-in\">What deficiencies does FINMA identify in service provider management?<\/h2>\n<p>In Supervisory Communication 03\/2024, FINMA identified significant deficiencies in service provider management, including missing inventories, incomplete controls and insufficient integration into the internal control system.<\/p>\n<p>The communication is based on Article 29 paragraph 2 of the Financial Market Supervision Act, which governs the reporting obligation for cyberattacks and is in principle also relevant for small and medium-sized asset managers. FINMA also found that cyberattacks on service providers of supervised institutions were successful more often than average; the share of such successful attacks rose in subsequent years from around 25 to over 50 percent. Circular 2018\/3 on outsourcing at banks and insurers had already aligned supervisory practice with a principles-based approach and left the materiality assessment of outsourcing arrangements more to the institutions&#8217; own responsibility.<\/p>\n<p>A loss of EUR 89 million at an ICT service provider illustrates how quickly gaps in controls can become financially material.<\/p>\n<h2 id=\"a4-what-structure-does-effective-governance\">What structure does effective governance of third-party risk require?<\/h2>\n<p>Effective governance combines a structured register with a continuously updated risk assessment and regular reporting to the governing body.<\/p>\n<p>According to the FINMA Risk Monitor 2024, one third of the cyberattacks on financial institutions reported to FINMA occur indirectly via third parties, which underlines the importance of continuous rather than point-in-time observation.<\/p>\n<p>A governance structure must define who assesses criticality, concentration and contractual risk, at what interval this assessment is updated, and which thresholds trigger escalation to executive management. The principle that risk management serves the achievement of objectives, not itself, applies directly to the governance of third-party risk.<\/p>\n<h2 id=\"a5-what-first-step-leads-from-list-to-steer\">What first step leads from list to steering?<\/h2>\n<p>The first step is to extend the existing vendor register with fields on criticality and concentration, enabling a recurring assessment rather than a one-off recording exercise.<\/p>\n<p>Those responsible for third-party risk management should determine, before the next review of the register, which metrics are reported regularly to executive management, for example the share of critical providers, open audit findings, or contracts without a documented exit strategy. Equally important is clarifying who within the organization is responsible for updating the risk assessment and at what interval this happens. Governance that answers these questions does not automatically satisfy every supervisory requirement, but it creates the basis on which such compliance becomes possible in the first place.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>From list to resilient steering<\/h3>\n<p>The Third-Party Risk Management solution maps register, risk assessment and escalation paths within a single structure, and supports reporting to executive management with traceable data.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/ar\/tprm-software\/\">Third-Party Risk Management <\/a><\/p>\n<\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>Extend the ICT third-party provider register with fields on criticality, substitutability and contract duration, as required by Art. 28(3) DORA.<\/li>\n<li>Establish a recurring risk assessment that is reported regularly to the governing body, as required by the EBA guidelines on outsourcing.<\/li>\n<li>Review internal service provider management against the gaps identified by FINMA: missing inventories, incomplete controls, insufficient integration into the internal control system.<\/li>\n<li>Define thresholds above which a third-party provider triggers escalation to executive management.<\/li>\n<li>Document exit strategies for critical contracts before a supervisory authority asks for them.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What distinguishes a vendor register from effective third-party risk governance?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>A vendor register only records names and contracts. Effective governance extends this register with data fields on criticality, substitutability and concentration, links these to a continuously updated risk assessment, and ensures regular reporting to the governing body, as required by DORA and the EBA guidelines.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What does Article 28(3) DORA require for the ICT third-party provider register?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Article 28(3) DORA obliges financial entities to maintain a register of all contractual arrangements with ICT third-party providers and to report it to the competent supervisory authority. Beyond this, DORA requires a strategy for ICT third-party risk, due diligence assessments before contract conclusion, and clear requirements on contract content and exit strategies.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">How many critical ICT third-party providers were designated under DORA in November 2025?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>On 18 November 2025, the European Supervisory Authorities EBA, EIOPA and ESMA designated 19 critical ICT third-party providers under DORA for the first time. The designation was based on register data from financial entities, from which a criticality assessment was derived using systemic importance, role in critical functions, and substitutability.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What deficiencies did FINMA identify in service provider management?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>In Supervisory Communication 03\/2024, FINMA identified missing inventories, incomplete controls and insufficient integration of service provider management into the internal control system. It also found that the share of successful cyberattacks on service providers of supervised institutions rose from around 25 to over 50 percent.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What share of reported cyberattacks on financial institutions occurs via third parties?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>According to the FINMA Risk Monitor 2024, one third of the cyberattacks on financial institutions reported to FINMA occur indirectly via third parties. This figure underlines why continuous rather than point-in-time monitoring of third-party risk is necessary.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.fma.gv.at\/en\/cross-sectoral-topics\/dora\/dora-managing-of-ict-third-party-risk\/\" target=\"_blank\" rel=\"noopener nofollow\">DORA &#8211; Managing of ICT third-party risk<\/a><span class=\"rc-source-pub\">Austrian Financial Market Authority (FMA)<\/span><\/li>\n<li><a href=\"https:\/\/www.eba.europa.eu\/publications-and-media\/press-releases\/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital\" target=\"_blank\" rel=\"noopener nofollow\">Designation of critical ICT third-party providers<\/a><span class=\"rc-source-pub\">European Banking Authority<\/span><\/li>\n<li><a href=\"https:\/\/www.eiopa.europa.eu\/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital-2025-11-18_en\" target=\"_blank\" rel=\"noopener nofollow\">Designation of critical ICT third-party providers<\/a><span class=\"rc-source-pub\">European Insurance and Occupational Pensions Authority (EIOPA)<\/span><\/li>\n<li><a href=\"https:\/\/www.finma.ch\/de\/news\/2017\/12\/20171205-mm-rs-outsourcing\/\" target=\"_blank\" rel=\"noopener nofollow\">FINMA publishes outsourcing circular<\/a><span class=\"rc-source-pub\">FINMA<\/span><\/li>\n<li><a href=\"https:\/\/www.eba.europa.eu\/documents\/10180\/2761380\/EBA+revised+Guidelines+on+outsourcing_DE.pdf\/5546a705-bff2-43eb-b382-e5c7bed3a2bc\" target=\"_blank\" rel=\"noopener nofollow\">Guidelines on outsourcing arrangements EBA\/GL\/2019\/02<\/a><span class=\"rc-source-pub\">European Banking Authority<\/span><\/li>\n<li><a href=\"https:\/\/www.handelszeitung.ch\/insurance\/it-auslagerungen-erhohen-cyberrisiken-drastisch-792082\" target=\"_blank\" rel=\"noopener nofollow\">Article on the FINMA Risk Monitor 2024<\/a><span class=\"rc-source-pub\">Handelszeitung Insurance<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Effective governance of third-party risk needs more than a vendor register: it combines structured register data on criticality and substitutability with a continuously updated risk assessment and regular reporting to the governing body. DORA, the EBA guidelines on outsourcing and FINMA supervision require this structure, because a register alone does not remedy the deficiencies in service provider management that supervisory authorities have identified.<\/p>\n","protected":false},"author":5,"featured_media":70427,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Rajeev Dutt","real_author_title":"Managing Director MEA & APAC","real_author_bio":"Builds the presence of Swiss GRC in Dubai and across the markets of the Middle East, Africa and Asia, seeing first-hand how differently local regulators interpret governance and compliance. This cross-jurisdictional perspective shapes his view of international markets.","real_author_photo":54679,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[151,152,153,154,155],"class_list":["post-70334","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-dora-third-party-risk","tag-ict-third-party-provider-register","tag-eba-guidelines-on-outsourcing","tag-finma-service-provider-management","tag-third-party-risk-management"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Third-Party Risk Governance: From Register to Steering\" \/>\n\t\t<meta property=\"og:description\" content=\"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t\t<meta property=\"og:image:height\" content=\"667\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-29T06:01:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-17T12:52:03+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Third-Party Risk Governance: From Register to Steering\" \/>\n\t\t<meta name=\"twitter:description\" content=\"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#blogposting\",\"name\":\"Third-Party Risk Governance: From Register to Steering\",\"headline\":\"Third-Party Risk Governance: From Vendor Register to Steering\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/08\\\/tprm-monitor-1000-en.jpg\",\"width\":1000,\"height\":667,\"caption\":\"From supplier inventory to risk management\"},\"datePublished\":\"2026-08-29T08:01:32+02:00\",\"dateModified\":\"2026-09-17T14:52:03+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, DORA third-party risk, ICT third-party provider register, EBA guidelines on outsourcing, FINMA service provider management, Third-Party Risk Management\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#listItem\",\"name\":\"Third-Party Risk Governance: From Vendor Register to Steering\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#listItem\",\"position\":3,\"name\":\"Third-Party Risk Governance: From Vendor Register to Steering\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/\",\"name\":\"Third-Party Risk Governance: From Register to Steering\",\"description\":\"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/08\\\/tprm-monitor-1000-en.jpg\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#mainImage\",\"width\":1000,\"height\":667,\"caption\":\"From supplier inventory to risk management\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/third-party-risk-governance-from-vendor-register-to-steering\\\/#mainImage\"},\"datePublished\":\"2026-08-29T08:01:32+02:00\",\"dateModified\":\"2026-09-17T14:52:03+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Third-Party Risk Governance: From Register to Steering<\/title>\n\n","aioseo_head_json":{"title":"Third-Party Risk Governance: From Register to Steering","description":"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.","canonical_url":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#blogposting","name":"Third-Party Risk Governance: From Register to Steering","headline":"Third-Party Risk Governance: From Vendor Register to Steering","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg","width":1000,"height":667,"caption":"From supplier inventory to risk management"},"datePublished":"2026-08-29T08:01:32+02:00","dateModified":"2026-09-17T14:52:03+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#webpage"},"articleSection":"Regulation &amp; Supervision, DORA third-party risk, ICT third-party provider register, EBA guidelines on outsourcing, FINMA service provider management, Third-Party Risk Management"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#listItem","name":"Third-Party Risk Governance: From Vendor Register to Steering"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#listItem","position":3,"name":"Third-Party Risk Governance: From Vendor Register to Steering","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#webpage","url":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/","name":"Third-Party Risk Governance: From Register to Steering","description":"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg","@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#mainImage","width":1000,"height":667,"caption":"From supplier inventory to risk management"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/#mainImage"},"datePublished":"2026-08-29T08:01:32+02:00","dateModified":"2026-09-17T14:52:03+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Third-Party Risk Governance: From Register to Steering","og:description":"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.","og:url":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg","og:image:width":1000,"og:image:height":667,"article:published_time":"2026-08-29T06:01:32+00:00","article:modified_time":"2026-09-17T12:52:03+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Third-Party Risk Governance: From Register to Steering","twitter:description":"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/08\/tprm-monitor-1000-en.jpg","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"7 minutes"},"aioseo_meta_data":{"post_id":"70334","title":"Third-Party Risk Governance: From Register to Steering","description":"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.","keywords":null,"keyphrases":{"focus":{"keyphrase":"Third-Party Risk Governance","score":0,"analysis":[]},"additional":[{"keyphrase":"DORA third-party risk","score":0,"analysis":[]},{"keyphrase":"ICT third-party provider register","score":0,"analysis":[]},{"keyphrase":"EBA guidelines on outsourcing","score":0,"analysis":[]},{"keyphrase":"FINMA service provider management","score":0,"analysis":[]},{"keyphrase":"Third-Party Risk Management","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"Third-Party Risk Governance: From Register to Steering","og_description":"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Third-Party Risk Governance: From Register to Steering","twitter_description":"DORA and FINMA require more than a vendor register. Learn how third-party risk governance combines risk assessment with reporting to executive management.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-17 12:52:08","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-08-28 19:01:32","updated":"2026-09-17 13:11:43","focus_keyword":"Third-Party Risk","additional_keywords":[{"word":"DORA third-party risk","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"ICT third-party provider register","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"EBA guidelines on outsourcing","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"FINMA service provider management","score":78,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"Third-Party Risk Management","score":76,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":2},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tThird-Party Risk Governance: From Vendor Register to Steering\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/"},{"label":"Third-Party Risk Governance: From Vendor Register to Steering","link":"https:\/\/swissgrc.com\/ar\/third-party-risk-governance-from-vendor-register-to-steering\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=70334"}],"version-history":[{"count":2,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70334\/revisions"}],"predecessor-version":[{"id":70337,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70334\/revisions\/70337"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/70427"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=70334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=70334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=70334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}