Germany – October 28, 2026 -- Vendors selling to EU banks, hospitals or energy providers are being pulled into DORA and NIS2 obligations through contractual flow-down, regardless of where they are headquartered, according to Sergiy Lapin, CEO of Passeca Germany.
Customer contracts, not legal text, now define regulatory scope
Lapin says supplier contracts now carry DORA and NIS2 clauses even in countries where regulatory transposition is not finalized. His summary of the shift: "'We are not in scope' was the 2024 answer." By 2026, he argues, vendors must say their customers are in scope and prepare accordingly.
Passeca, a Hyperproof MSSP partner, offers incident response, security awareness, vCISO services and compliance support.
Single compliance leads face 30-day questionnaire deadlines
Passeca often finds one compliance lead running the entire program. That person may be mid-cycle on SOC 2 audit preparation when a key customer sends a DORA questionnaire with a 30-day deadline. With no extra headcount, Lapin describes the manual workload as a direct commercial risk to the customer relationship.
Vendor lists sit in procurement spreadsheets while security questionnaires sit in compliance tools. The lack of coordination duplicates effort and drives audit burnout.
NIS2 sets 24-hour, 72-hour and one-month reporting deadlines
NIS2 requires an early warning within 24 hours of an incident, a formal notification within 72 hours and a final root-cause analysis within one month. DORA sets a similarly aggressive window. Passeca repeatedly finds incident response runbooks written for internal escalation rather than regulator-facing notification under a legal deadline.
DORA makes management bodies personally accountable for cybersecurity
Under DORA, management bodies must formally approve cybersecurity measures and complete mandatory security training. Lapin says boards can no longer rely on delegating to a CISO. Boards now ask whether the organization is resilient rather than merely compliant, which challenges CISOs trained to report control completion percentages.
Passeca outlines three steps for DORA and NIS2 readiness
Asset inventory: Engagements open with three questions: what the asset is, where it is and who owns it. Lapin notes that controls and frameworks cannot be layered on without a complete inventory.
Register of Information: DORA requires a living register of all ICT third-party relationships mapped to critical business functions. Passeca advises seeding it from the contract repository, pulling active contracts involving data processing or system access. Teams then rank vendors by whether a four-hour failure would stop customer service. Passeca says this approach reaches 80% coverage in two weeks, versus two quarters for teams starting from blank templates.
Board reporting: Passeca coaches GRC leaders to lead with exceptions rather than figures such as 247 of 251 controls green. It also advises replacing metrics such as an 85% TPRM completion rate with statements like "twelve critical third parties have no tested exit plan." Boards should also get scenarios, such as what happens by Tuesday if the top critical vendor fails on Monday.
Passeca uses Hyperproof's Hierarchical Scopes to model complex organizational structures and Hyperproof TPRM to automate third-party risk assessments and document reviews.