The chain is the target
A compromised provider account, a booby-trapped update, an unavailable host: the attack or the outage comes through a trusted third party. Your risk surface is now your suppliers’ as much as your own.
Topic · Managing third-party risk
Map and track critical providers
Third-party risk depends on what a provider can reach, how critical the service is, the data processed and whether the provider can be replaced. Galyct Pro brings this information together with the contractual requirements and the evidence received, so you can track priority third parties and exit plans.
Understand the risk. Take back control. Stay the course.
Hosted in France with Scaleway · Mistral AI (EU) · NIS 2 & DORA supply chain requirements.
You can only protect well what you have mapped.
Outsourcing an operation never transfers responsibility for continuity, trust and compliance. As long as you do not know which provider accesses which data, how critical it is and under what guarantees, third-party risk stays invisible, until the day it becomes your incident. Galyct Pro links each third party to a criticality level, contractual requirements and evidence, so that the chain becomes something you can steer.
01 · WHY IT HAS BECOME CENTRAL
The weak link is no longer necessarily on your side
Dependence on providers and software has exploded, and regulators have taken note. Three reasons to manage third-party risk now.
NIS 2 & DORA require it
NIS 2 requires supply chain security; DORA requires a register of ICT third-party providers, contractual clauses and management of concentration risk. It is no longer good practice: it is an obligation.
You are being asked for it
Large-account customers, insurers, public contracting authorities: they all demand proof that you have your subcontractors under control. An up-to-date register and defensible clauses unlock a contract or a policy.
02 · WHAT GALYCT PRO BRINGS
A third-party register linked to decisions and evidence
Not a forgotten spreadsheet: living steering, connected to your risk, your compliance and your continuity.
Mapping
See and rank
Who accesses what, and what is critical.
- Register of providers, software vendors and subcontractors
- Criticality by data access, dependence and replaceability
- Mapping of access, flows and hosting locations
- Detection of concentrations and single points of failure
Require & prove
Frame and demonstrate
Clauses that are honoured, evidence you can present.
- Security, GDPR (Art. 28) and exit requirements per third party
- Tracking of clauses, audits, certifications and attestations received
- Exit plan: reversibility, continuity and switchover
- Material ready for an audit, an insurer or an authority
03 · THE METHOD
From the inventory to the exit plan
Proportionate steering: start with the critical third parties, document what matters, keep a record.
1InventoryProviders, software vendors, sub-processors, hosts and the access associated with them.
2ClassifyCriticality by data processed, operational dependence, replaceability and location.
3RequireSecurity, GDPR, notification, audit and exit clauses, proportionate to the risk.
4VerifyAttestations, certifications, audit results and evidence received, with their expiry dates.
5MonitorAlerts, incidents and substantial changes at a third party, reported to the right place.
6Plan the exitReversibility and continuity plan in case of failure or end of contract.
04 · WHAT WE DO NOT PROMISE
Assessing a third party reduces the risk, it does not eliminate it
Managing third-party risk shrinks the blind spot and makes your requirements defensible. It does not remove a provider’s risk, nor does it guarantee the provider’s security on its behalf.
Not an audit of your providers
Galyct Pro structures your requirements and your evidence; it does not carry out a supplier’s technical audit for you. When needed, the firm takes over.
Not the third party’s security
We make the dependence readable and require guarantees; a provider’s internal security is its own responsibility. Control of the risk, however, remains something you can steer on your side.
Compliance linked to real practices
A register that is never updated protects no one. We document the third parties that are genuinely critical and the related decisions, not a decorative list.
Not a decision made for you
Accepting a third-party risk, changing provider or requiring a clause is a decision for management. Galyct Pro informs the trade-off; the responsibility and the record are yours.
05 · TO GO FURTHER
Third-party risk is part of overall steering
It connects naturally to risk, compliance and continuity.
Manage risk
Mapping, EBIOS RM and trade-offs: make all cyber risk readable and prioritised, third parties included.
See the module →Document compliance
NIS 2, DORA, ISO 27001, GDPR: the supply chain is an explicit requirement of these frameworks.
See the module →Ensure continuity
The failure of a critical third party is a continuity scenario: BIA, BCP, DRP and switchover plans.
See the module →See your supply chain in your context.
A 30-minute live demo on your critical providers and your NIS 2 / DORA obligations. Or start on your own with the free executive diagnosis. No commitment.