How do we decide what NIS2 asks of us for the security of our supply chain?

Start

NIS2 may apply to us and our suppliers hold our systems or data

NIS2 treats supply chain security as one of ten measures. It asks an entity to look at its relationships with its direct suppliers and service providers, and it adds a few things to the supplier security work you may already do. The management body approves these measures, supply chain security among them, and oversees how they are put in place. This question sets out what the Directive adds. The general supplier questions still decide tiering, evidence and clauses.

• Then: Are we an essential or important entity under NIS2?

Decision

Are we an essential or important entity under NIS2?

The supply chain duty falls on essential and important entities. If you are not sure whether you are one, settle the scope question first. If you are clearly not one, only a customer in scope can bring these terms to you, and the next question covers that case.

• Yes: List your direct suppliers and service providers
• No: Does a customer in scope of NIS2 ask us for security terms?
• Not known: Settle whether NIS2 applies to you first, then come back

Outcome

Settle whether NIS2 applies to you first, then come back

The supply chain duty falls on essential and important entities. Run the scope question and return.

Decision

Does a customer in scope of NIS2 ask us for security terms?

You are not an essential or important entity, so NIS2 does not bind you directly. Your customers may still pass their duty on to you in their contract or questionnaire. Treat the request as a normal customer ask with a known reason behind it.

• Yes: Read the request against what a customer in scope must ask
• No: Nothing for NIS2 to add here; answer customers as they ask

Outcome

Nothing for NIS2 to add here; answer customers as they ask

You are not an essential or important entity and no in-scope customer is asking. Keep your normal supplier practice. Do not say you comply with NIS2.

Step

List your direct suppliers and service providers

The measure is about each entity's relationships with its direct suppliers or service providers. List them with what each provides. For some digital providers a regulation requires a kept directory with contact points and the products and services each supplier gives, so keep yours in that shape anyway.

• Then: Does the supplier carry significant data, access or dependency?

Decision

Does the supplier carry significant data, access or dependency?

Tier the supplier by what it can do to you if it fails or is breached: the data it holds, the access it has, how much a service depends on it. The third-party pack's tiering model does this. Not known takes the yes branch until you have looked. Do this for each supplier on the list.

• Yes, or not known: Judge the supplier's own weaknesses and practices
• No: Apply standard terms and review the supplier on its cycle

Step

Apply standard terms and review the supplier on its cycle

A low-tier supplier gets the standard clauses and a lighter, periodic review. Record the tier and why, so that you can show the choice was proportionate to the risk. The standard terms still include the incident notice clause, and so does any supplier that holds your data.

• Then: Are we a cloud, data centre, managed service or similar provider?

Step

Judge the supplier's own weaknesses and practices

The Directive asks you to take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including its secure development. A standard questionnaire alone does not show that. Look at how it builds, patches and handles its own suppliers.

• Then: Check the evidence covers the service you use and is in date

Step

Check the evidence covers the service you use and is in date

A certificate that does not cover the service, entity or region you buy proves little. Check scope, dates and who issued it. For cloud providers' certificates and reports, use the question on cloud evidence.

• Then: Ask for the clauses that fit the tier

Step

Ask for the clauses that fit the tier

Typical content is security requirements, incident notice, vulnerability handling, rules on subcontracting, audit rights or audit reports, and return or deletion of data at the end. Take the wording from the clause library and keep what you asked for and what you got.

• Then: Can the supplier's incident notice reach you before your own deadline?

Decision

Can the supplier's incident notice reach you before your own deadline?

Your early warning to the authority is due within 24 hours of becoming aware of a significant incident, as the Directive sets it. A supplier that tells you late uses your time. Ask for notice without undue delay and an outer limit that leaves you room. Not known takes the answer no.

• Yes: Does the supplier refuse a term you need?
• No, or not known: Add or tighten the incident notice clause

Step

Add or tighten the incident notice clause

Use the incident notification clause and set its time against your own deadline. Where the supplier will not agree, record the gap as a supplier risk with an owner, and plan how you would learn of its incidents another way.

• Then: Does the supplier refuse a term you need?

Decision

Does the supplier refuse a term you need?

Refusal is a risk decision, not a reason to stop looking. Record what was refused and why it matters, then choose between an equivalent term, a compensating control, a recorded exception with an expiry, or another supplier.

• Yes: Take it as a recorded exception with an owner, or change supplier
• No: Are we a cloud, data centre, managed service or similar provider?

Step

Take it as a recorded exception with an owner, or change supplier

Use the exception route for the term you cannot get. Name the owner, the compensating control and the date it expires. If the supplier is critical to a service, treat a standing refusal as a reason to plan an exit.

• Then: Are we a cloud, data centre, managed service or similar provider?

Decision

Are we a cloud, data centre, managed service or similar provider?

A Commission Implementing Regulation sets detailed measures for DNS, TLD, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, search engine and social network providers, and trust service providers. For them it is an extra duty. For every other entity it does not apply.

• Yes: Write the supply chain security policy that regulation requires
• No: Monitor suppliers and watch for EU-level supply chain assessments

Step

Write the supply chain security policy that regulation requires

It governs your direct suppliers, sets criteria for choosing and contracting them, lists what contracts should say, and is reviewed at planned intervals and after significant changes or incidents. It also needs the supplier directory. Check the current text of the Regulation for the detail.

• Then: Monitor suppliers and watch for EU-level supply chain assessments

Step

Monitor suppliers and watch for EU-level supply chain assessments

Reassess on the cycle for each tier and after a supplier incident or change. The Directive also lets the EU Cooperation Group assess particular critical supply chains; if one covers something you use, take its results into account. Do not wait for one before acting.

• Then: Does a customer in scope of NIS2 ask us for security terms?

Decision

Does a customer in scope of NIS2 ask us for security terms?

Your customers may pass the supply chain duty on to you in their contract or questionnaire. Your own NIS2 duties are separate from this. A customer in scope has its own duty to look at your practices, and may pass terms on to you. Treat the request as a normal customer ask with a known reason behind it.

• Yes: Read the request against what a customer in scope must ask
• No: Supplier relationships tiered, evidenced, contracted and monitored

Step

Read the request against what a customer in scope must ask

Expect questions on your security practices and secure development, incident notice, vulnerability handling, subcontractors, audit or audit reports and data return. Separate what you already do from what you would be taking on, and do not accept terms in the questionnaire that you have not read.

• Then: Can we perform every term as written?

Decision

Can we perform every term as written?

Do not sign a term you cannot perform, such as a notice time you cannot meet. A term you can meet in another form can be offered as equivalent wording.

• Yes: Agree the terms; do not claim this makes you NIS2 compliant
• No, or not known: Offer equivalent wording or take it to leadership and Legal

Outcome

Offer equivalent wording or take it to leadership and Legal

Say which term you cannot meet and what you can offer. Where the customer insists and the term is one you cannot perform, the decision to accept the commercial risk belongs to leadership with Legal, not to the person filling the form.

Outcome

Agree the terms; do not claim this makes you NIS2 compliant

Keep the agreed terms with the contract. Signing customer terms shows you accepted duties. It does not show you comply with NIS2, and it does not make you an essential or important entity.

Outcome

Supplier relationships tiered, evidenced, contracted and monitored

Keep the tier reasons, evidence checks, clause choices, recorded exceptions and review dates. Do not say your suppliers are NIS2 compliant: the Directive does not certify suppliers, and the duty to assess them stays with you.