NIS2 Supply Chain Security: What to Ask Your Suppliers

What the directive requires

Supply chain security is one of the ten minimum measures in Article 21(2) of NIS2: point (d) covers "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers". Article 21(3) says what to take into account when choosing measures:

the vulnerabilities specific to each direct supplier and service provider;
the overall quality of their products and cybersecurity practices, including their secure development procedures;
the results of the EU's coordinated security risk assessments of critical supply chains under Article 22(1).

Note the word direct: your obligation is about your own suppliers, but a good assessment asks how they manage theirs.

The detailed model: Implementing Regulation (EU) 2024/2690

For DNS providers, TLD registries, cloud, data centre and CDN providers, managed and managed security service providers, online marketplaces, search engines, social networks and trust service providers, section 5 of the Annex to Implementing Regulation (EU) 2024/2690 spells out the requirements. Other entities follow their national law, but this is the most concrete reference available and a sound model for anyone.

1. A supply chain security policy (point 5.1.1)

A policy that governs relations with direct suppliers and service providers to mitigate the identified risks, identifies your role in the supply chain, and is communicated to suppliers.

2. Selection criteria (point 5.1.2)

the supplier's cybersecurity practices, including secure development;
its ability to meet the cybersecurity specifications you set;
the overall quality and resilience of its ICT products and services, and the security measures built into them;
your ability to diversify sources of supply and limit vendor lock-in, where applicable.

3. Contract clauses (point 5.1.4)

Based on the policy and your risk assessment, contracts specify, where appropriate and possibly through service level agreements:

Clause	Point
Cybersecurity requirements for the supplier, including for ICT products and services it provides	5.1.4(a)
Awareness, skills, training and, where appropriate, certifications of the supplier's staff	5.1.4(b)
Background verification of the supplier's staff	5.1.4(c)
Notification without undue delay of incidents that present a risk to your network and information systems	5.1.4(d)
The right to audit or to receive audit reports	5.1.4(e)
Handling of vulnerabilities that present a risk to your systems	5.1.4(f)
Subcontracting rules, and security requirements for subcontractors where allowed	5.1.4(g)
Obligations at termination, such as retrieval and disposal of your information	5.1.4(h)

4. Ongoing monitoring (points 5.1.6 and 5.1.7)

Review the policy and monitor suppliers' security practices at planned intervals and after significant changes or incidents: check service level reports, review supplier-related incidents, decide on unscheduled reviews and document them, and analyse the risk of changes to suppliers' products and services.

5. A supplier directory (point 5.2)

Keep an up-to-date register of direct suppliers and service providers with a contact point for each and the ICT products, services and processes they provide.

Questions to ask a supplier

Who is responsible for security in your organisation, and do you have an approved information security policy?
Which certifications or independent assurance do you hold (ISO 27001, SOC 2, penetration test summaries)?
How do you develop software securely, and how do you find and fix vulnerabilities in what you deliver to us?
Do you enforce multi-factor authentication and least-privilege access for staff who can reach our data or systems?
How fast will you notify us of an incident affecting us, and through which channel? (If you are under NIS2, you need this to meet your own 24-hour early warning.)
Which subcontractors support the service, and where do they and our data sit?
How do you back up and restore the service, and when did you last test it?
What happens to our data at the end of the contract?

Score the answers: the free Vendor Risk Assessment turns supplier answers into a risk rating and a review date.

Make it proportionate

Article 21(1) asks for appropriate and proportionate measures. Tier your suppliers: full assessment and contract clauses for those with access to critical systems or sensitive data; a short questionnaire for the rest; and a register for everyone. Re-assess critical suppliers at least yearly and after any incident involving them.

Run the programme from one pack. The Vendor Security Assessment Pack includes a vendor security questionnaire, an onboarding checklist, a risk register, a security requirements addendum with NIS2 incident-notification and DORA clauses, an exit plan template and a data processing agreement.