Third-party supplier risk management: what can we learn from the Danfoss case?

From the illusion of perimeter security to reflected vulnerabilities

In October 2026, the so-called “Danfoss case” provided particularly clear evidence of how a vulnerability in the digital supply chain can have immediate consequences even for physical infrastructure. During the night of 11–12 October, a cyberattack targeted the remote control systems used to manage the refrigeration systems in hundreds of French supermarkets. The attackers are believed to have altered the parameters of the controllers associated with Danfoss solutions, interfering with the automatic defrost cycles and the operating temperatures of the refrigerated display cabinets.

Rather than merely disrupting the services, the attackers are said to have reprogrammed the operation of the equipment: the defrost threshold temperature was raised to values between 35 and 50 °C, the cycle duration extended to eight hours, and the restart of the compressors prevented. The result was the spoilage of meat, fish, dairy products and frozen foods, leading to serious financial losses and, in some shops, alerts about overheating. The chains reportedly affected included Intermarché, Netto, Carrefour, Carrefour Market, Coopérative U, E.Leclerc and Monoprix.

The intrusion is said to have primarily affected controllers exposed to the internet and running obsolete or out-of-date software versions, including releases prior to version 4; in the hours that followed, similar alerts emerged concerning devices from another manufacturer as well. This incident brings home the concept of reflected vulnerabilities: the weakness of a component or a technology supplier is directly transferred to the organisations using it, to the point of compromising operational continuity, physical security and the availability of assets.

The absence of a ransom demand has also fuelled speculation that the action was aimed at sabotage rather than financial gain; however, such attributions and motives must be treated with caution until supported by official conclusions. This case confirms that asset inventory, timely updates, network segmentation, remote access control and continuous monitoring of suppliers are no longer merely supplementary measures, but essential requirements for third-party risk governance.

The regulatory paradigm shift between NIS2, DORA and ACN

The evolution of the European Union’sregulatory framework clearly expresses the principle that an organisation’s cybersecurity extends beyond its internal systems. The NIS2 Directive (EU Directive 2022/2555), transposed in Italy by Legislative Decree No. 138 of 4 September 2024, explicitly includes supply chain security in Article 21 amongst the minimum and essential risk management measures.

The legislation requires essential and important operators to assess the specific vulnerabilities of each direct supplier, the overall quality of products and the cybersecurity practices adopted, with particular attention to secure software development procedures and coordinated risk assessments conducted at European level in accordance with Article 22.

Complementarily, the DORA Regulation (EU Regulation 2022/2554), applicable to the financial sector from 17 January 2025, stipulates in Article 28 that financial entities retain full responsibility for compliance with legal obligations even when they outsource ICT services. DORA requires the adoption of a specific strategy for third-party ICT risk management, the maintenance of a register of information for all active contracts, the conduct of rigorous pre-contractual due diligence, the assessment of concentration risks, and the preparation of documented and tested exit strategies for critical or important functions.

Article 30 of DORA also sets out the mandatory minimum contractual clauses, ranging from a detailed description of service levels (SLAs) to the exact location of data, as well as rights to on-site inspections and mandatory participation in advanced operational resilience tests (Threat-Led Penetration Testing or TLPT).

The different nature of the two texts reflects a balanced approach: NIS2 operates on the principles of proportionality and risk-based accountability, whilst DORA sets out highly prescriptive and uniform rules, whilst also introducing a power for European authorities to exercise direct supervision over ICT providers deemed ‘critical’. In Italy, theNational Cybersecurity Agency (ACN) has further fleshed out these principles by stipulating that NIS entities must annually register and declare their ‘relevant suppliers’ via the ACN platform, specifying their tax code, registered office and classification of purchases.

The most significant change lies in the penalty and governance regime. Compliance can no longer be delegated solely to IT or cybersecurity functions. Under the NIS2 Directive, financial penalties for essential entities can reach 10 million euros or 2 per cent of global turnover. Furthermore, both NIS2 and DORA establish the direct and personal liability of management bodies and boards of directors, providing for the possibility of direct administrative sanctions against executives and their temporary suspension from managerial duties in the event of non-compliance with supply chain obligations.

Mapping and technical due diligence: methodology and assessment

The first operational hurdle in implementing a TPRM programme (Third-Party Risk Management) is the lack of a unified view of suppliers. Often, procurement records, the security team’s spreadsheets, business unit managers’ files and GDPR processing records do not align with one another. The essential starting point is the creation of a single, dynamic inventory, capable of linking each supplier to the services provided, the systems and data involved, the level of access granted, the criticality of the business process and the actual replacement times.

Once mapped, the supplier portfolio must undergo a triage and categorisation process. A cleaning services provider raises questions relating to physical security, whilst a cloud provider hosting corporate databases or a software house developing code integrated into authentication systems requires a rigorous level of scrutiny.

The classification must be based on objective parameters: the sensitivity of the data processed, the depth of logical access, the presence of sub-contractors, geographical location and the risk of concentration arising from dependence on a single provider.

For suppliers classified at the highest levels of criticality, a purely documentary approach based on self-completed questionnaires has clear limitations. Questionnaires remain useful for understanding governance frameworks, but must be supplemented by empirical, multi-source checks:

• Cybersecurity Rating Tools: analysis of the external attack surface through the assessment of DNS configurations, SSL certificates, visible vulnerabilities, exposed credentials and mentions on the dark web
• International standards and certifications: verification of ISO/IEC 27001 compliance and, above all, examination of SOC 2 Type II reports, which are essential for certifying not only the design of controls but also their actual operational effectiveness over an extended period
• Penetration testing and secure development: review of recent penetration test reports conducted by independent third parties, analysis of secure software development procedures (Secure Software Development Lifecycle) and assessment of operational continuity and disaster recovery plans
• Dedicated technical audits: conducting in-depth audits or on-site inspections in cases characterised by maximum operational and strategic impact.

Finally, assessments must incorporate a Risk Analysis of geopolitical and sovereignty risks. The processing or storage of data in countries subject to intrusive legislation, government interference or technological export restrictions introduces strategic vulnerabilities that NIS2 and DORA require to be formally considered in the assessment processes.

Contractual architecture: translating security into binding clauses

Risk assessment defines the supplier’s security posture, but it is the contract that serves as the legal instrument transforming technical and regulatory requirements into enforceable operational obligations. Generic clauses regarding ‘due diligence’ or ‘compliance with best practice’ offer no real protection. Modern contractual architecture is structured through Cybersecurity Addenda or Data Protection and Security Agreements (DPSAs) annexed to the main contract.

To meet the requirements of NIS2 and DORA, the contractual structure must include specific, non-negotiable pillars:

Audit and inspection rights: the right for the client and the competent authorities to carry out documentary checks, on-site inspections and technical scans, with a corresponding obligation on the supplier to cooperate

Incident management and notification: the obligation to report any cyber incident, even a potential one, within extremely tight timeframes (aligned with the 24- or 72-hour deadlines set out in the regulatory frameworks and the ACN), providing details on the nature of the incident and the countermeasures takenManagement of the subcontractor chain (Fourth Parties): the obligation to cascade the same security requirements down the entire subcontractor chain, coupled with a prohibition on subcontracting critical functions without the client’s prior written authorisationExit Strategies: structured clauses guaranteeing the return or certified destruction of company data, providing for an orderly transition period during which the outgoing supplier continues to provide the services to avoid operational disruptions (lock-in)Dynamic and remedial mechanisms: the inclusion of clauses providing for the automatic updating of controls in response to evolving threats, rights to periodic review, and the right to suspend or terminate the contract immediately in the event of a serious deterioration in the supplier’s security posture.

During commercial negotiations, large cloud service providers or managed software providers often resist granting unlimited on-site audit rights or customised notice periods. Overcoming such deadlocks requires the adoption of tailored solutions: the acceptance of independent third-party audit reports, the use of industry-specific contractual frameworks, and the adoption of collaborative TPRM platforms for the standardised exchange of security evidence.

Continuous monitoring, corporate culture and ongoing challenges

Signing the contract does not mark the end of risk management. As a supplier’s security posture changes over time, continuous monitoring is the fundamental operational phase.

As it is not feasible to carry out continuous audits on every partner, organisations must adopt periodic scorecards based on external indicators (new zero-day vulnerabilities, public data breaches, changes in corporate structure) and carry out constant reviews of corporate access rights, with a specific focus on non-human identities such as API keys, tokens and service accounts.

Despite methodological advances, TPRM presents unresolved complexities that corporate governance must manage with a balanced approach:

• Balancing rights: harmonising the client’s right to audit with the protection of the supplier’s trade secrets and confidentiality
• Non-EU jurisdictions: managing suppliers based outside the European Union operating in regulatory contexts where European supervisory authorities lack direct access
Sustainability for SMEs: preventing audit fatigue amongst small and medium-sized supplier enterprises, whilst avoiding the paralysing bureaucratic overload caused by the proliferation of questionnaires
• Software quality: objectively measuring the actual quality of secure software development without placing an excessive burden on costs and release times.

Addressing these challenges requires a cultural shift. Third-party risk management has moved beyond mere compliance to become an integral part of the board of directors’ governance framework.

Organisations capable of establishing a robust TPRM programme reduce their exposure to attacks, speed up response times in the event of a crisis, and transform regulatory compliance into a mark of reliability and a tangible competitive advantage in the market.

Comparative overview of third-party risk management strategies

The following table summarises and compares the main stages of the TPRM lifecycle, outlining the technical aspects, relevant European regulatory references and related contractual instruments:

Luca Bonora Cybersecurity Evangelist, Cyberoo

CYBEROO Evangelist

LinkedIn