CESIN and Board of Cyber unveil the 3rd edition of the Supplier Cyber Risk Observatory

Conducted among IT, cybersecurity, and compliance decision-makers from French and European organizations of all sizes, the study from the Supplier Cyber Risk Observatory shows that companies have fully integrated supplier risk into their risk mapping: more than 8 out of 10 organizations consider this risk "important" or "very important," and 60% have now centralized its management at headquarters level.

This awareness is rooted in a demanding regulatory environment (NIS2, DORA, CRA), which applies to 84% of respondents and is accelerating the maturation of practices. Regulation acts as a catalyst: it drives accountability across all players in the supply chain.

CISO and Executive Committee: broader governance

Managing supplier cyber risk is increasingly becoming a collective effort. The Group CISO remains the most involved function (87%), but Legal (60%, up from 11% in 2024) and Procurement (60%) are now fully engaged—evidence of stronger cross-functional ownership. In more than one company out of two (54%), the topic is now monitored by General Management or the Executive Committee, rising to 82% in the most regulated sectors such as banking and insurance.

This expanded governance reflects greater maturity around supplier risk, even if operational monitoring often still underestimates it. It also shows recognition of a business issue: it is no longer merely a technical subject, but a performance driver.

Pooling emerges as an efficiency lever

Faced with the growing volume of assessments and the complexity of supply chains, 80% of companies say they are ready to pool their supplier assessments. However, they set clear conditions: a shared framework, a consistent scope (sector, size, maturity level, etc.), and an institutional trust framework based on legitimate assessment players. This trend reflects a strong aspiration to simplify, standardize, and share controls between peers rather than duplicating them.

Several CISOs want to go further and are calling for the creation of a universal continuous-assessment platform, based on a single evaluation framework and a cyber score—similar in spirit to the "Nutri-Score."

CISOs looking for tools and cooperation

Cybersecurity leaders express a need for automation and industrialization of supplier assessment processes (pooled platforms, cyber ratings, etc.), as well as for stronger involvement from suppliers themselves. Half of respondents want suppliers to become active participants in their own security. This signals a deeper shift: moving from a control mindset to a partnership mindset. It also illustrates growing maturity in third-party risk management—companies no longer question the need to assess it; they now want to industrialize and simplify its management.

"The new regulatory context is profoundly transforming the management of Supplier Cyber Risk, which has become systemic. A change in method is required. This is what the 2025 edition shows: a clear rise in maturity, but also the need to accelerate pooling and standardization of practices in order to reach a new level."

Frank VAN CAENEGEM

Vice President CESIN, CISO EMEA Schneider Electric

Alain BOUILLÉ

General Delegate, CESIN

"This study is extremely useful for anyone who wants to understand how supplier cyber risk has become a strategic issue for governance and corporate resilience. The demand for pooled and automated supplier risk assessment is a clear signal to the entire cyber ecosystem."

Luc DECLERCK,

Managing Director, Board of Cyber

---

→ This study was conducted between July and September 2025 among IT / cybersecurity / compliance decision-makers from 171 organizations of all sizes and sectors, all managing complex supplier networks.

ABOUT CESIN

CESIN (Club des Experts de la Sécurité de l’Information et du Numérique) is a non-profit association founded in July 2012 with the aim of professionalizing and promoting cybersecurity. As a place for exchanges, knowledge-sharing, and experience-sharing, CESIN enables cooperation between information security and digital experts, as well as between these experts and public authorities. It contributes to national initiatives and provides recommendations on regulatory texts, guidelines, and other frameworks. CESIN’s members include several bodies and institutions such as the French National Cybersecurity Agency (ANSSI), the National Gendarmerie, Cyber Command, the French Data Protection Authority (CNIL), Gimelec, the Police Prefecture, the Criminal Investigation Department, Cybermalveillance.gouv.fr, the Ministry of Justice, and the Ministry of the Interior. CESIN has more than 1,200 members from all activity sectors—industries, ministries, and companies, including CAC40 and SBF120 groups.

cesin.fr