One supplier record. Every regulation that references it.

Vendor risk is typically assessed once at contract signing and rarely revisited, while NIS2 Art. 21(2)(d) and DORA's ICT third-party chapter both expect continuous oversight. TruSecure maintains one continuous supplier risk register that feeds every regulation referencing supplier or third-party risk simultaneously.