Resources
Practical reading for teams that oversee suppliers: articles, guides, regulation explainers and answers to common questions.
Start here
- BlogAnalysis of outages, regulation and third party failures, and what they mean for oversight teams.Read the blog
- GuidesStep-by-step guidance on materiality, the DORA Register of Information, due diligence, exit plans and Nth parties.Browse the guides
- RegulationsWhat PRA SS2/21, DORA, EBA and other regimes expect, and how the platform supports each one.Explore regulations
- FAQAnswers about the platform, how it uses AI, how data is protected and the regulation it is built around.Read the FAQ
- Trust centreTenant isolation, hosting in Europe, access controls, responsible AI and how to request security documentation.Visit the trust centre
- Trestec GameVendor Materiality Speed Dating: 12 suppliers, 60 seconds, one materiality call for each under PRA SS2/21.About the game
Latest articles
Notes on regulation, resilience and supply chains.
Resilience
Google’s outage, Revolut’s customers: what this means for operational resilience
What the Google Cloud and Revolut disruption tells us about supplier dependencies, recovery arrangements and the customer impact of an outage.
6 min read
Resilience
Heathrow, NATS and the Cost of Third-Party Failure: Lessons for Financial Services
The NATS outage that grounded more than 1,000 flights shows how a critical third party's failure becomes your operational, financial and reputational problem. Lessons for banks, insurers and regulated firms.
13 min read
Guides
What Is Third Party Risk Management (TPRM)? TPRM Made Easy.
A complete guide to third party risk management: what TPRM is, why it matters, the lifecycle, and how to manage due diligence, contracts and monitoring.
15 min read
Regulation
The PRA's New Third Party Rules Are Coming. Is Your Supplier Spreadsheet Ready?
From 18 March 2027, PRA regulated organisations face new rules for material third party arrangements. Here is what your supplier spreadsheet is missing, and how to prepare.
12 min read
Guides
Longer guidance for the work regulators and auditors look at most closely.
- RegulationHow to assess materiality under PRA SS2/21A practical method for deciding which outsourcing and third party arrangements are material, recording why, and keeping that view current.
- RegulationBuilding a DORA Register of InformationWhat the register must contain, how the templates link together, and how to build a register that survives submission checks.
- Due diligenceRunning supplier due diligence that scalesHow to keep due diligence proportionate across hundreds of suppliers: tiering, reusable evidence, clear review and a sensible refresh cycle.
- ResilienceWriting and testing exit plansWhat a credible exit plan covers, the difference between stressed and planned exit, and how to test a plan without leaving the supplier.
- ResilienceMapping Nth parties and concentration riskHow to see the subcontractors behind your suppliers, find where several services rely on the same provider, and decide what to do about it.
- ESGModern slavery statements: what to collect from suppliersThe evidence that supports a credible modern slavery statement, and how to collect it from suppliers in proportion to risk.
Regulation explainers
Plain summaries of what each regime expects from supplier oversight, with how Trestec supports it.
- PRA SS2/21Supervisory expectations for outsourcing and third party risk management.
- DORAEU requirements for digital operational resilience in financial entities.
- EBA Outsourcing GuidelinesGovernance and risk expectations for outsourcing arrangements.
- ISO 27001 supplier controlsSupplier relationships within an information security management system.
- ESG and modern slaveryEvidence-led supplier checks for environmental, social and labour risks.
- US third party risk managementInteragency lifecycle guidance, NYDFS security policy and SEC service provider oversight.
- Gulf regionOutsourcing oversight across Saudi Arabia, the UAE, Qatar and Bahrain.
- Singapore (MAS)MAS outsourcing, technology risk and business continuity frameworks.
A clearer view of supplier risk, monthly
Regulatory change, resilience and third party risk, in one short note.
Prefer to talk it through? Book a demo or contact the team.