NIS2 and supply chain security

Are you in scope?

Directive EU 2022/2555 replaced the original NIS Directive and applies through national implementations. Two categories matter.

Essential entities

Energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration, space.

Important entities

Postal and courier, waste management, chemicals, food, manufacturing of medical devices, computers and electronics, machinery, motor vehicles, digital providers, research.

Size threshold

Generally medium sized and above: 50 or more staff, or turnover above 10 million euro. Some entities are in scope regardless of size.

The indirect route

If you supply an in-scope entity, their Article 21 obligations become your contractual obligations. This is how most firms actually encounter NIS2.

What Article 21 requires on supply chain

Article 21(2)(d) is short and unusually direct. Risk management measures must include supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.

Article 21(3) then requires you to take into account each supplier's specific vulnerabilities, the overall quality of their products and their cybersecurity practices, including their secure development procedures.

Article 20 makes management bodies approve the risk measures and oversee implementation, and states that they can be held liable. Training for management is mandatory, not advisory.

Where annual questionnaires fall short

• "Overall quality of practices" is not a yes or no field. Article 21(3) asks for a judgement about how a supplier operates. A questionnaire captures what they say about themselves on one day.
• Self-attestation is the weakest evidence available. NIS2 does not say take their word for it. Where a claim is publicly checkable, checking it is the obvious minimum.
• Personal accountability changes the standard of proof. When a director is liable, "we sent a questionnaire" is thin. A dated record of what was verified is not.
• Incident reporting is on a clock. Early warning within 24 hours, notification within 72. If a supplier is the source, you need to know what they run before the clock starts, not during.

What continuous verification looks like

Direct suppliers first

Article 21(2)(d) names direct suppliers. Start there and go deeper only where criticality justifies it.

Observable practice, not stated practice

Mail authentication, certificate hygiene, published policies and breach history are all public and all indicative of how an organisation is actually run.

A record with dates

Every check timestamped, so you can show a regulator or a board what was known and when.

Change as the trigger

The finding that matters is the day something regresses, not the annual snapshot that missed it.

Management reporting

Article 20 requires the management body to oversee this. That needs a report they will actually read, not a spreadsheet export.

Practical first steps

1. Confirm scope, including whether you are caught indirectly through a customer's obligations.
2. List direct suppliers and mark those touching an essential service.
3. Check what is publicly observable about each one today. Free, and it takes minutes per supplier.
4. Set a cadence and a reporting line into the management body, because Article 20 requires it.

Start with the free vendor check, and see the report format a management body receives.