What it asks for. The organisation must assess and review the supply chain-related risks associated with suppliers or contractors and the systems, components or services they provide, at a defined frequency.
In practice. This means tiering suppliers by criticality, assessing the most important ones in depth through questionnaires, certificates, audit reports or on-site reviews, and reassessing periodically and after incidents or significant changes. Auditors expect the supplier register with tiers, assessment records and follow-up of findings. DORA and NIS2 both emphasise this kind of ongoing supplier oversight. Results should feed procurement and renewal decisions.
Common gaps. Assessments are often done once at contract signature and never repeated. Fourth parties, the suppliers of suppliers, are rarely considered. Assessment findings may also be recorded but never followed up with the supplier.