Securing NIS2, DORA compliance in the cloud supply chain

The European Union's NIS2 Directive and Digital Operational Resilience Act, together with the implementing and delegated acts adopted under them, including the DORA's regulatory and implementing technical standards, shape the cybersecurity landscape across the EU and apply to entities operating across a wide range of sectors. 

Both regulatory frameworks place significant emphasis on third-party and supply chain risk management. However, the business models, operating practices and technological characteristics of software-as-a-service cloud providers create a markedly different reality in which customers often have limited visibility into their providers' security controls and dependencies. 

As a result, conducting meaningful third-party risk assessments and effectively managing supplier-related risks can become significantly more challenging in practice.

Supply chain compromise: A growing cybersecurity threat

The European Union Agency for Cybersecurity, ENISA, published its 2025 Threat Landscape report in October 2025. The report identifies supply chain compromise as one of the defining trends in the EU cyber threat landscape. While supply chain threats account for 10.6% of the threats categorized by ENISA, the report's examples illustrate how the compromise of a single trusted provider or dependency can affect multiple downstream organizations.

The report highlights a clear increase in attacks targeting service providers, managed service providers, software repositories, open-source ecosystems and browser extensions, demonstrating that adversaries increasingly prefer indirect attack paths over attacking organizations directly. According to ENISA, both state-aligned threat groups and cybercriminal operators are exploiting digital dependencies to achieve greater scale and operational efficiency.