Who runs our accounting system? Who has remote access to our network, and since when? What does the contract say about incident reporting? In most organisations the answers sit in three different places: the accounting system, a spreadsheet kept by the network administrator and a folder of signed contracts.
Both the Czech Cybersecurity Act and the DORA regulation expect supplier records to be in order before an inspection, not after it starts. The Suppliers module in Observa keeps suppliers, their contracts, access rights, assessments and review dates in one place, and it flags what is missing.
Questions we hear most often about suppliers
- How do we show an auditor that our suppliers have been assessed, not merely invoiced?
- What exactly has to be in a supplier contract, and how do we know it is really there?
- Which of our suppliers count as significant, and how are we supposed to tell them?
- Where does our data sit when a supplier processes it in a cloud service?
Observa answers them like this.
What the rules require
Czech law implements NIS2 through the Cybersecurity Act (Act No. 264/2025 Coll.) and two decrees. In the higher-duty regime, suppliers are covered by Section 9 of Decree No. 409/2025 Coll. The regulated organisation sets rules for suppliers and demonstrably informs them of those rules, manages supplier related risks, identifies and records its significant suppliers, informs them in writing that they are recorded as significant, makes sure that contracts with them contain the relevant provisions listed in Annex 5 to the decree, and reviews performance of those contracts regularly. For significant suppliers it also has to assess risks before signing and check implemented security measures regularly. A significant supplier is one whose services matter for the cybersecurity of the regulated service.
In the lower-duty regime the requirement is shorter, but it exists. Under Section 3(5) of Decree No. 410/2025 Coll., the organisation has to take into account threats and vulnerabilities related to the supplier and the overall quality of the products and cybersecurity practices of that supplier, including secure development practices, and make sure the contract contains the relevant clauses from Annex 2 to the decree.
Financial entities follow the DORA regulation. Article 28 states that ICT third-party risk is an integral part of the ICT risk management framework, that using an external provider does not transfer responsibility for compliance, that the entity maintains a register of information on all contractual arrangements for the use of ICT services and reports on them to its competent authority at least once a year, and that services supporting critical or important functions need documented exit strategies. Article 29 adds a preliminary assessment of ICT concentration risk and Article 30 sets out what a contract has to contain, with a considerably longer list where the service supports a critical or important function. ISO/IEC 27001 has a comparable requirement for suppliers.
Whether the Czech act applies to you, and in which regime, is a judgement we do not make on your behalf. For a first estimate there is our Cybersecurity Act calculator.
How Observa handles it
A supplier register that shows the state at a glance
Every supplier has a contact, an owner, a status, a criticality level, a risk rating and a completeness score for its records. Criticality follows the assets the supplier can access or is linked to, the risk rating follows recent questionnaires and the highest open risk of that supplier. The list therefore shows straight away which suppliers matter and where the gaps are.
The supplier register shows criticality, risk rating, record completeness and contract validity.
Supplier type and nature of cooperation instead of long forms
You assign a supplier to a type, for example SaaS, cloud infrastructure, IT outsourcing, custom software development or consulting and audit, and the type prefills the nature of the cooperation and the required levels of evidence. The nature of cooperation records logical and physical access, confidential information, data retention and personal data. Based on the regulatory profile of your organisation, Observa adds the regulatory classification: relation to the regulated service, significant supplier in the higher-duty regime, or ICT service provider supporting a critical or important function under DORA.
Six record requirements that make gaps visible
For every supplier, Observa tracks the contract, the contract checklist, records of supplier staff, links to assets, access management and the supplier assessment. Each requirement is set to Required, Recommended or Not applicable. Anything the law requires is locked and cannot be switched off. For the rest, a manager can lower the level through a justified exception for a limited period, so it stays traceable who decided what and why.
Contracts with a checklist for your regime
Each contract comes with a checklist of required clauses that Observa builds from the applicable rules and the regime of the organisation: one list for the higher-duty regime, another for the lower-duty regime, a different one under DORA and a longer one where the supplier supports a critical or important function. A contract can be sent for approval to two groups of approvers, with a four-eyes rule and a deadline for approval. Certificates, audit reports, service level agreements, non-disclosure agreements, data processing agreements and standard contractual clauses are stored with their validity dates, so an expiring document does not go unnoticed.
Questionnaires the supplier fills in
A security questionnaire or a cloud service questionnaire is sent to the supplier by e-mail with a unique link and a verification code. The supplier needs no account in the application. Observa turns the answers into a risk index and converts it into a risk rating on the scale your organisation defines.
Staff, access and links to assets
For each supplier you record its staff and staff groups and their access to assets, services or the whole environment. Supplier staff are at the same time external people in the People and identities module. The supplier itself is a supporting asset in the asset inventory, so you can see which primary assets and services depend on it.
Countries and data location
For every supplier you record the country of its registered office, the places where the service is provided, where data is stored and processed, where support sits, the role under the GDPR, the purpose of processing, the transfer mechanism to a third country, the assessment record and any further processors. The first three types of country match the structure of the DORA register of information. A separate overview then shows where data leaves the European Economic Area.
For an ICT supplier you can see the critical functions it supports and the data DORA expects to be recorded.
What Observa does on its own
- It creates a risk from a gap in the records. Is a contract, an assessment or an access record missing for a significant supplier? The risk is created automatically, with its source in the supporting asset of that supplier, and it closes itself once the finding is gone. How you treat it is your decision.
- It reports contradictions. If the nature of cooperation says the supplier retains personal data but the data location fields are empty, Observa flags it and creates a task to complete them.
- It runs reviews. A nightly job creates review tasks for staff, access, contracts and questionnaires according to the intervals you set, and moves a supplier with an overdue review to the Under review status.
- It points out a new DORA duty. As soon as the asset links show that a supplier supports a critical or important function, its owner gets a task to complete the contractual provisions required by Article 30(3) of the regulation.
- It derives requirements from the regulatory profile. The profile of your organisation decides which supplier requirements apply, which checklist a contract gets and how the notifications to suppliers are worded.
- It connects assessment frameworks. An answer in one framework is proposed as the answer to related requirements in other frameworks, so supplier assessment is not repeated for every framework from scratch. A person always accepts or rejects the proposal. Mapping between frameworks is available in the Enterprise plan.
Connecting your other systems
- REST API (from the Professional plan): new suppliers from procurement or an ERP system arrive in the register on their own, and you can read back the type, record completeness, ICT significance or supported critical functions. Lowering the regulatory classification through the API is not possible, that is done in the application with a justification.
- Import from an Excel workbook or CSV and CSV export (from the Starter plan): a quick start from the spreadsheet you keep today, and an export of whatever the filtered list shows.
- PDF reports (from the Starter plan): a supplier summary report, an access report and a supplier risk report for auditors and for management.
- E-mail outside the application: questionnaires and formal notifications to suppliers with confirmation of receipt, without creating accounts.
- Single sign-on and SCIM (Enterprise plan only): people sign in with the company identity and accounts are created and removed from the company directory.
- Trust Center: selected suppliers can be listed as subprocessors on your public page with a public description of their purpose, so your own customers do not have to ask support.
Security, simplicity and overview
Data is encrypted in transit and at rest, including the database, files and attachments are encrypted with a key for each organisation, organisations are separated from each other, two-factor authentication is available in every plan and every change leaves an audit trail. Observa runs in data centres in the European Union. Getting started is simple: the regulatory profile decides what applies to you, suppliers come in from a spreadsheet, questionnaire and notification templates are ready and help is built into the application. And the overview is in one place instead of spreadsheets and e-mail threads: the state of records for each supplier, tasks with deadlines, alerts on upcoming reviews and reports in one click.
What you get out of it
When an auditor or a supervisor asks about suppliers, there is nothing to collect. The assessment, the contract with its checklist, the list of access rights and the review history sit together and can be exported to PDF. Management can see which suppliers are critical and where the gaps are, without asking anyone to update a spreadsheet. And gaps do not get lost, because each one becomes a risk and a task with a deadline.
Frequently asked questions
Which plan includes the Suppliers module
The Professional plan and above. The Starter plan does not include the Suppliers module. The assessment frameworks for the Czech Cybersecurity Act, DORA and the GDPR are in every plan and are not a paid add-on.
Our suppliers are in a spreadsheet, how do we get them into Observa
Through an import from an Excel workbook or CSV using a prepared template. A file check first shows what will be created, what will change and what will be skipped, and only then does the import run. Import is available from the Starter plan.
Who works with the module
A contributor creates and edits suppliers, uploads contracts and sends questionnaires. A manager approves, sets exceptions from requirements, lowers the classification with a justification and terminates a supplier. A module administrator maintains supplier types and module settings. Permissions can be set separately for each module.
Does Observa produce the DORA register of information
Observa keeps supplier data in the structure of the DORA register of information, meaning the country where the service is provided and where data is stored and processed, and the critical functions supported. It does not yet produce a separate register output in the format required by the supervisor.
How to start
Set the regulatory profile, import suppliers from your spreadsheet, add contracts and access rights for the most important ones, and Observa will offer the rest as tasks. The first few suppliers take an afternoon.
Try Observa for free
You can try Observa for 7 days free of charge, with no card required. Would you rather see it on your own situation? We are happy to show you, just get in touch. The Suppliers module is part of the Professional plan at 6 490 CZK per month or 64 900 CZK billed annually, and Observa starts at 2 990 CZK per month. Prices are shown excluding VAT, the full overview is in the price list.
What Observa is built on and how the modules fit together is described in our introduction to the platform. Next Monday we look at incidents and reporting: when and to whom an incident is reported, within which deadlines, and how Observa prepares the report.
Sources: Act No. 264/2025 Coll. on cybersecurity · Decree No. 409/2025 Coll., Section 9 on supplier management · Decree No. 410/2025 Coll., Section 3(5) on suppliers · DORA regulation, Articles 28 to 30 on ICT third-party risk