Third-party risk in outsourcing is no longer just a procurement concern. Under NIS2 and DORA, it is a regulatory obligation that sits with the buyer. When a vendor is breached, regulators now ask what you did to assess, contract for,…