NIS2, DORA and GDPR: how to assess your security vendor’s sovereignty
Short answer: NIS2, DORA and GDPR make your security vendor part of your regulated supply chain. To assess NIS2 supply chain risk, check the vendor’s ownership, where data is stored and processed, and where the people who access it are based. Compliance is the floor, not the goal.
Key takeaways
- Your cybersecurity vendor is part of your supply chain risk under NIS2 and your data processing chain under GDPR.
- Ownership, data location and analyst location all affect your exposure.
- Vendor marketing language such as “European” or “EU hosting” needs to be checked against terms and policies.
- Real security outcomes matter as much as the compliance label.
Why regulators are looking at your vendors
Regulation in Europe has moved from “protect your own network” to “answer for everyone who touches it.” NIS2 asks organizations to manage supply chain security. DORA asks financial entities to control ICT third-party risk. GDPR asks you to know who processes personal data and where.
Your security vendor sits in all three. It sees your endpoints, your logs and often your most sensitive systems.
That makes vendor choice a sovereignty decision as well as a technical one. In this article you will learn:
- How NIS2, DORA and GDPR connect to vendor sovereignty
- What to look for in ownership, data handling and service delivery
- How to run the review without a six-month project
How do NIS2, DORA and GDPR relate to vendor sovereignty?
Each regulation touches a different part of the vendor relationship, and together they point to the same question: who can reach your data, and under which laws?
| Regulation | What it asks of you | What to check in a vendor |
|---|---|---|
| NIS2 | Manage supply chain security risk | Ownership, jurisdiction, service delivery location |
| DORA | Control ICT third-party risk in financial services | Operational resilience, where analysts and support sit |
| GDPR | Know who processes personal data and where | Data location, transfers outside the EU, staff access |
None of these laws says “buy a European vendor.” They do ask you to understand and document your exposure. A vendor built for them makes that documentation far easier.
What to examine: three layers of vendor risk
Layer 1: Ownership and jurisdiction
A vendor’s headquarters is not the same as its ownership. A company can be based in Europe and still be owned by a non-European investor, which brings that jurisdiction’s governance into the picture. Ask who owns the vendor and what legal demands could reach it.
WithSecure is headquartered in Finland, founded in 1988, and owned by CVC, a European investment firm, and its Finnish founder. There is no foreign parent company or state control.
Layer 2: Data location and transfers
Check more than the hosting region. Read the privacy policy and terms for data transfer language. Watch for phrases such as “depending on your location and the services you use, data may be transferred outside the EU.”
A preference to process data in the EU is not the same as a commitment. For organizations with strict requirements, that difference can be a deal-breaker.
Also ask about subprocessors, such as third-party email security components, which may store data in other regions.
Layer 3: Who delivers the service
This is the layer most often missed. MDR analysts, support staff and responders see your security data. If they sit outside Europe, EU hosting does not change who is acting on your environment.
WithSecure services are delivered from Europe, subject exclusively to European laws. Data is stored, processed and acted upon within European borders, by analysts located in Europe, under European governance.
A practical review process
- Ask for ownership details. Request the parent company and ultimate owner, in writing.
- Request a data flow map. Include storage, processing, support access and subprocessors.
- Ask where analysts and support teams are located. Get a named list of countries.
- Read the terms. Highlight any language on transfers outside the EU and on “preference” for EU processing.
- Check software origin. Ask where development and release take place, and who is allowed to do it.
- Look for independent validation. Industry evaluations can confirm what vendors claim. See Blog 4 for examples.
- Test outcomes. Ask for detection and response results, not only compliance certificates.
Common challenges and solutions
| Challenge | Solution | WithSecure approach |
|---|---|---|
| Vendors claim to be European, but ownership is unclear | Request the ownership chain | European-owned and European-run, no foreign parent |
| Policies leave room for data transfers outside the EU | Seek explicit EU-only commitments | Data stored in Ireland, accessed by personnel under EU law |
| MDR analysts located outside Europe | Require analyst location in writing | Analysts in Europe, under European governance |
| Compliance becomes a checkbox | Add outcome-based criteria | Regulation sets the floor, real security outcomes keep you safe |
Why this matters for MSPs
If you are an MSP, your partners’ regulatory exposure becomes your conversation. Customers in finance, healthcare and critical infrastructure will ask where their data goes. A sovereign platform gives you a clear answer.
Elements gives you one European platform covering exposure management, detection and response and managed services, so you answer sovereignty questions once, not per product. We work beside you: you stay the hero, we stay the safety net.
Frequently asked questions
Does NIS2 require a European cybersecurity vendor? No. NIS2 requires you to manage supply chain security risk. A European vendor under EU jurisdiction makes that risk easier to assess and document, because ownership, data handling and staff location fall under EU law.
How does DORA affect my choice of security provider? DORA requires financial entities to manage ICT third-party risk. Your security provider is one of those third parties, so you need clarity on where services are delivered, who accesses data and how the provider handles resilience.
What should I ask a vendor about GDPR data processing? Ask where data is stored and processed, who accesses it, whether transfers outside the EU can occur and which subprocessors are involved. Request written answers and check them against the vendor’s privacy policy.
Is an EU-hosted MDR service the same as a European MDR service? Not necessarily. EU hosting says where data sits. A European MDR service also means analysts located in Europe, operating under European governance. Ask for both in writing.
Conclusion: make sovereignty part of the review
NIS2, DORA and GDPR do not tell you which vendor to pick. They do tell you to know your supply chain. Make ownership, data location and analyst location standard questions in every security review.
WithSecure is built to answer all three: European origin, EU data hosting and European service delivery, with no exceptions and no fine print.
Blog post
Read our latest blogs