Most companies can produce a vendor list. Far fewer can say which of those vendors would stop a critical service if they went down, when each was last assessed, or what happens if one is breached, sanctioned or sold.

Financial services had to answer these questions first. From March 2027, the UK’s PS26/2 requires a register of critical vendors and fast incident reporting, as DORA does in the EU, while the UK’s Cyber Security and Resilience Bill and the EU’s NIS2 extend supply chain security to other critical sectors.

The practices behind these rules are good third-party risk for any company, regulated or not.

Vendor programs break in familiar places: static spreadsheets, questionnaires that are filed and forgotten, contracts nobody revisits, and hidden dependence on a few cloud providers. The panel shares how companies move from one-off checks to continuous monitoring, stay audit-ready all year, and win back hours of manual work.

Join this webinar to learn:

• What the strictest third-party risk rules, from the UK’s PS26/2 to the EU’s DORA, get right, and how any company can apply those practices without waiting for a regulator
• How to spot concentration risk across vendors and their subcontractors, and build contingency and exit plans before an outage tests them
• How to put the data you already hold to work: reusing questionnaire answers, re-reviewing legacy contracts and using AI to cut manual effort without handing over judgement