Recommended Free Tools
Not automatically. A customer’s NIS2 status does not by itself make every supplier directly subject to the directive. But covered customers must manage cybersecurity risks in their supply chains, so they may assess suppliers and seek security commitments or evidence through procurement and contracts. Your own direct NIS2 obligations depend on your activities, size, and the national rules that apply to your business.
What NIS2 requires of a covered customer
Article 21 of the EU’s NIS2 Directive (EU) 2022/2555 requires essential and important entities to take appropriate and proportionate technical, operational, and organisational measures to manage risks to the security of the network and information systems they use. Those measures include supply-chain security, including security aspects of relationships with direct suppliers and service providers.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
NIS2 Compliance Guide (Companion Book) | $55.00 | Buy on Amazon |
| 2 |
|
NIS2 Practical Compliance for SMEs | $30.00 | Buy on Amazon |
| 3 |
|
NIS2 Compliance Guide | $95.00 | Buy on Amazon |
| 4 |
|
Mastering NIS2 Compliance: A Tactical Field Manual for CISOs and Compliance Directors: Navigating... | $29.95 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The legal duty described in Article 21 is imposed on the covered entity. It is not a rule that automatically converts every supplier into an essential or important entity. A supplier can still face practical consequences: a customer may review its security, request evidence, or negotiate requirements into a contract. If the supplier agrees to contractual terms, those terms may bind it; that is distinct from being directly regulated under NIS2.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat a customer may ask suppliers to show or agree to
ENISA’s June 2025 version 1.0 technical implementation guidance describes how relevant entities can develop supply-chain security policies and manage relationships with direct suppliers and service providers. It advises entities to identify their role in the supply chain and consider recognised standards or good practices when developing policy.
#1 Best Overall
Depending on the customer’s policy and risk assessment, supplier questionnaires or contracts may address topics such as:
- Cybersecurity requirements for the supplier’s products or services.
- Staff awareness, skills, training, and, where appropriate, certifications.
- Employee background verification where relevant.
- Supplier incident notification without undue delay.
- Audit rights or the provision of audit reports.
- Vulnerability handling and remediation.
- Subcontracting and security expectations for subcontractors.
- Retrieval or disposal of information when the contract ends.
These are possible topics, not a universal set of clauses every supplier must accept unchanged. A request’s relevance depends on the service, the systems and information involved, the assessed risk, and the parties’ agreement.
Which supplier relationships are most likely to receive scrutiny
The clearest focus is on direct suppliers and service providers whose products or services can affect a covered customer’s network and information systems. Depending on the relationship and risk, that may include ICT, software or hardware suppliers, cloud services, managed service providers, and managed security service providers.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →This does not mean every vendor, or every company somewhere in a multilevel supply chain, automatically faces identical requirements. A customer’s assessment should be tied to its actual services, direct relationships, risks, and relevant subcontracting chain. Suppliers should understand what they provide to the customer and which systems, data, or operations the service touches before deciding what evidence or controls are relevant.
Rank #3
How to prepare for an NIS2-related supplier review
ENISA’s guidance identifies policy and contract topics for covered entities; it does not create a standalone universal readiness checklist for suppliers. As practical preparation, a supplier can organise the information most likely to help a customer assess the relationship:
- Describe the service and its security boundaries. Explain what you provide, which customer systems or information it can affect, and which security controls apply to that service.
- Document the incident process. Identify who handles security incidents, how the customer is notified, and how vulnerabilities are escalated. Compare the proposed notification terms with your operational process before agreeing to them.
- Map relevant subcontractors. List subcontractors involved in delivering the service and understand how security expectations and incident escalation apply to them.
- Assign an owner for customer requests. Designate someone who can coordinate questionnaires, provide consistent evidence, and bring technical or legal questions to the right people.
- Review contract terms against the service and risk. Pay particular attention to incident notifications, audits or reports, vulnerability handling, subcontracting, and return or disposal of information at termination.
These steps help organise a response; they do not establish that a supplier is legally compliant or in scope. Avoid promising controls, notification times, audit access, or subcontractor commitments that your organisation cannot deliver.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check whether your company is directly in scope
Assess direct NIS2 scope separately from customer procurement demands. The Directive’s scope depends on factors including the organisation’s sector and activities, and NIS2 is implemented through Member State laws. The applicable national framework may affect how scope criteria operate and what local duties apply. The European Commission’s NIS2 policy page provides EU-level context, but a supplier should check the current law and guidance for the relevant country and sector before relying on a conclusion about its own status.
Do not infer a reporting deadline, regulator, penalty, or effective date from a customer’s request alone. Those details require checking the applicable national implementation and any sector-specific rules. A supplier may also have obligations under other laws or because of its own status, independently of a customer’s NIS2 obligations.
What the 86% supply-chain statistic does—and does not—say
ENISA’s June 2023 report on good practices for supply-chain cybersecurity says 86% of surveyed organisations had implemented ICT/OT supply-chain cybersecurity policies. The report describes this as a finding based on a 2022 study, so it is a historical survey result—not a current estimate, a NIS2 compliance rate, or proof that a particular supplier is ready.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
