Compliance

In the Black Kite platform, the Compliance Score is a percentage reflecting how many recognized controls a company complies with out of the total number of controls identified through internet-facing documents, user-uploaded documents, and technical scans. The score increases when controls are found to be compliant, either through document review or technical scan detection. A higher score indicates fewer compliance gaps; a lower score highlights areas that need improvement. It can be calculated across all frameworks or for a specific selected framework.

What Does Compliance Mean for Third-Party Risk?

Compliance reaches third parties because most modern rules hold the customer responsible for vendor security. Customers can't hand an obligation to a vendor and consider it met. They need ongoing evidence that the vendor's controls match the requirement.

Standards and regulations differ in how they treat third-party risk, and their scope keeps widening. NIST's Cybersecurity Framework added supply chain risk in version 1.1 (2018). Each change adds vendors to the set of relationships a program has to evidence.

Where Do Compliance Requirements Come From?

Compliance requirements come from four places, and a single vendor relationship can fall under all of them.

Each source asks for evidence in a different form:

Laws: privacy and sector rules such as GDPR and HIPAA, which set duties for the data an organization handles.
Regulations and directives: rules such as NIS2 and DORA, which set operational and supply chain duties.
Standards and frameworks: published control sets such as ISO 27001, NIST CSF, PCI-DSS, and SOC 2.
Contracts: customer and partner terms that require specific controls, reporting, or audit rights.

Because the sources overlap, one control can satisfy several requirements at once. That overlap is why programs map controls across frameworks and treat the rules as one body of evidence.

How Do NIS2 and DORA Make Compliance a Vendor Question?

NIS2 and DORA turn vendor oversight into a legal duty for the customer. Black Kite's European cyber risk research points to three provisions that matter most to vendor programs under the NIS2 Directive and DORA:

NIS2 Article 21: makes supply chain security a required risk measure for every essential and important entity, and Articles 21(2)(d) and 21(3) cover suppliers specifically.
NIS2 Article 20: places accountability on the management body, so vendor gaps become a leadership issue.
DORA Article 28(6): requires ongoing monitoring of ICT providers for the life of the contract.

Penalties give those duties weight. NIS2 fines reach €10 million or 2% of global annual turnover for essential entities, whichever is higher, and €7 million or 1.4% for important entities. Under DORA, national financial regulators enforce the rules, fines vary by country, and Article 30(3)(e) requires contracts to secure the right to monitor continually.

How Does Compliance Differ From a Compliance Rating and Compliance Management?

Compliance is the outcome, and the work that produces it has two parts. Compliance management is the program of policies, reviews, and reporting that produces it. A compliance rating measures how closely one vendor's controls match a framework.

Ratings Show Alignment and Programs Create It

A program decides which frameworks apply, who reviews evidence, and how gaps get fixed. A rating reports where one vendor stands against those decisions. A team needs both to move from a requirement to proof.

A related measure is compliance completeness. Black Kite describes it as the percentage of recognized controls, derived from internet-facing documents, user-uploaded documents, and technical scans, relative to the total expected controls. It shows how much of a framework a vendor has evidenced.

Regulatory Risk Is the Cost of Falling Short

Regulatory risk is the exposure created when compliance fails, such as fines, enforcement actions, or contract penalties. Compliance is the state a team works toward. Regulatory risk is what that team carries when the state isn't reached.

Why Is Meeting Compliance Obligations Hard for Vendor Programs?

Meeting obligations is hard because knowing a rule exists and proving a vendor meets it are different jobs.

The same European research names three frictions:

Uneven NIS2 transposition: member states write the directive into national law, and transposition has been uneven.
A continuous questionnaire burden: DORA has turned into a steady flow of vendor questionnaires that burdens institutions and vendors alike.
Capacity gaps: teams are asked to deliver continuous oversight on an annual-review budget.

Each friction hits a different part of the program, so a team can face all three at once. Evidence gathered once and reused across frameworks eases the second and third.

What Are the Limits of Compliance?

Meeting a requirement doesn't stop a vendor from failing. In September 2025, ransomware hit Collins Aerospace's MUSE platform, a shared check-in and boarding system used by many airlines at European airports. Heathrow, Brussels, Berlin, Dublin, and Cork fell back to manual processing for days. None of those airports was breached itself, yet under the Critical Entities Resilience Directive (CER) they remain responsible for keeping essential services running when a supplier fails.

Compliance evidence is also a snapshot. A report or attestation describes a vendor on the date it was issued, and posture can shift afterward. Continuous monitoring covers the time between reviews.

How Does Black Kite Support Vendor Compliance Work?

Black Kite supports vendor compliance work through multi-framework assessment, external monitoring, and audit-ready reporting. The vendor compliance management solution connects with GRC tools such as ServiceNow and LogicGate. Teams can also build custom assessment frameworks when internal policy goes beyond a published standard.