NIS2 for suppliers and subcontractors

The essentials

The NIS2 dossier explains who is in scope. This page is for companies that sell to entities in scope and are receiving their first requests.

What the directive requires of your customers

The ten families of measures in Article 21 include supply chain security, “including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. To choose its measures, the entity takes into account the vulnerabilities specific to each direct supplier, the overall quality of its products and its cybersecurity practices, secure development procedures included.

Recital 85 encourages entities to write these measures into the contracts with their direct suppliers, and envisages that they consider the risks coming from other levels of the chain. This is how the requirements reach companies outside the scope.

In scope directly or by contract: the difference

Differences between a supplier directly subject to NIS2 and a supplier affected through its customers
	Supplier in scope	Supplier out of scope
Source of the requirement	The transposition law	The contract with the customer
Counterpart	The national authority	The customer
Reporting an incident	To the authority, within the directive’s deadlines	To the customer, within the contractual deadline
Verification	Supervision by the authority	Questionnaires and audits provided for in the contract
In case of failure	Administrative penalties	Consequences provided for in the contract

Providers directly in scope

Several supplier trades appear in Annex I themselves: cloud computing services, data centres, content delivery networks, managed services and managed security services. The directive defines a managed service provider as an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure or applications, via assistance or active administration, on customers’ premises or remotely. A managed services company, an integrator that provides maintenance or a monitoring provider fit that description. They enter the scope from medium size.

For a software vendor, the question is that of the cloud computing service, which recital 33 specifies includes software as a service. Selling licences for software that the customer installs and operates itself is not one.

What you will receive, and what to prepare

Requests sent to suppliers by entities subject to NIS2 and items to prepare
Customer request	What it covers	What you must be able to show
Security questionnaire	Governance, access, backups, patching, subcontracting	Dated answers, identical from one customer to the next, backed by documents
Reporting clause	The customer must warn the authority within 24 hours of becoming aware of a significant incident: it needs to be told without delay	An incident procedure and a reachable contact
Audit clause	The right to verify, on documents or on site	An agreed scope, notice period and confidentiality rules
Access requirements	Multi-factor authentication, named accounts, a trace of remote interventions	The list of access held at the customer and how it is protected
Secure development	The directive expressly mentions suppliers’ secure development procedures	Code review, dependency tracking, vulnerability handling

Keep an evidence file rather than answering case by case

Starting each questionnaire from scratch takes time and produces answers that diverge. A file kept up to date serves every customer:

the scope of the services provided and of the access held at customers;
the security policy and the name of its owner;
access management and multi-factor authentication;
backups and the date of the last restore test;
patch and vulnerability management;
the incident procedure and the notification deadline offered to customers;
the list of your own subcontractors and hosting providers;
existing certifications and audit reports, with their exact scope.

The points to settle before signing an NIS2 clause

What triggers notification: any security event, or the incidents that affect the service provided to the customer.
The starting point of the deadline and its length.
The scope and frequency of audits, and who bears their cost.
What the clause asks for your own subcontractors.

Frequently asked questions

Can a customer impose NIS2 on me when I am not in scope?

It cannot make you an entity within the meaning of the directive. It can make security measures a condition of the contract. The obligation is then contractual, and it can be negotiated.

Do I have to report an incident to the authority?

Only if you are yourself an essential or important entity. Otherwise, you inform your customer under the terms of the contract. It is the customer that assesses whether the incident is significant for its services and reports it.

Is ISO 27001 certification enough to answer customers?

It answers a large part of the questionnaires, provided the certified scope covers the service delivered to the customer. Reporting and audit clauses still have to be agreed.

Are my own subcontractors affected?

The directive first targets the entity’s direct suppliers, and envisages taking the following levels into account. Your customers can therefore ask which subcontractors are involved and expect you to pass certain requirements on to them.

We work for a bank: NIS2 or DORA?

DORA. For financial entities, that regulation applies instead of the NIS2 provisions on risk management, incidents and third-party providers. The requirements a bank or an insurer sends you come from DORA, whose Article 30 sets the minimum content of contracts; see the DORA note.

Check your situation

The guided NIS2 assessment starts by establishing whether you are in scope directly: entity, sector, size. It then covers governance, suppliers and incidents, and returns a first reading in about six minutes. For the size calculation, see NIS2 and SMEs.

Choose the NIS2 assessment Discuss your NIS2 scope

NIS2: what your customers will ask of their suppliers and subcontractors