Supply chain security under NIS2 – why your suppliers are your problem too

We have already mentioned that your customers will soon be asking about NIS2 – in an email from the procurement department, in a qualification questionnaire, or in tender specifications. This is no coincidence. NIS2 explicitly requires companies covered by the directive to assess the security of their suppliers. And this means that if you are a supplier to such a company, sooner or later this question will come your way too.

What exactly does the Directive say?

Article 21 of the NIS2 Directive lists supply chain security as one of the mandatory areas of risk management. Companies covered by the regulations must take into account not only their own systems and processes, but also:

• the security of their relationships with direct suppliers and service providers,
• vulnerabilities specific to each supplier and service provider,
• the overall quality of suppliers’ products and cybersecurity practices, including their secure software development processes.

In practice, this means that a company covered by NIS2 can no longer say, ‘Our supplier is responsible for their own security; it doesn’t concern us.’ Responsibility for risk assessment trickles down the supply chain – and with it come questions, security questionnaires and contractual requirements, for which the board of directors is ultimately responsible, not just the IT or procurement departments.

Why this also applies to smaller companies outside the scope of NIS2

This is one of the most frequently overlooked aspects of the directive. Even if your company is not formally subject to NIS2 – because it is too small or operates in a sector not covered by the regulations – it may still be ‘drawn into’ the requirements if it is a supplier or subcontractor to a company that is subject to NIS2. In practice, we are seeing this more and more often: large organisations are beginning to require specific security measures from their suppliers, as well as contractual provisions regarding incident reporting and the right to audit.

Companies that ignore this trend risk something very tangible – the loss of contracts, tenders and long-standing business relationships, not because they have broken the law, but because they fail to meet their counterparties’ expectations.

In practice, what does a company subject to NIS2 assess in its supplier?

There is no single, universal formula, but the following elements most commonly feature:

Basic cybersecurity hygiene – whether the supplier uses multi-factor authentication, manages updates and security patches, and has a backup policy.

Access management – who has access to systems or data related to the performance of the contract, and under what conditions.

Ability to report incidents – does the supplier have a procedure for informing the client of an incident that may affect the collaboration, and within what timeframe does it do so, bearing in mind that the directive itself imposes strict deadlines of 24 hours, 72 hours and one month for a full report.

Software security – particularly important for IT suppliers, system integrators and companies producing software or components used in the client’s services.

Business continuity – does the supplier have a contingency plan in the event of a failure, which minimises the risk of disruption to supplies or services?

How can you prepare for questions from clients?

Rather than waiting for the first security survey to land in your inbox with a tight deadline, it’s worth taking a proactive approach:

1. Take stock of your own security measures. Before anyone asks, it’s worth knowing for yourself where your company stands – what’s already in place and what’s missing.
2. Prepare a single, consistent response to common questions. Many security questionnaires ask the same things in different ways – it’s worth having a ready-made set of answers and documents that can be quickly adapted.
3. Organise your contractual records. Check whether your contracts with clients and subcontractors refer at all to security and incident reporting – if not, this is the first sign that they need updating.
4. Focus on documentation, not just actions. A company may follow good security practices, but without documentation it is difficult to prove this to a client during a formal verification process.
5. Do not treat this as a one-off exercise. Large contractors are increasingly requiring regular supplier reviews – this is an ongoing process, not a one-off questionnaire to ‘tick off’.

The supply chain works both ways

It is worth bearing in mind that if your company is subject to NIS2, it must also assess its own suppliers – not just respond to customers’ queries. This is a good time to look at business relationships from both sides: as the entity being assessed and as the entity doing the assessing.

Supply chain security is one of those areas of NIS2 that is easy to overlook until a specific question arises from a customer or partner. If you’d like to find out how to prepare your company – both as a supplier and as an entity assessing its own contractors – we’d be happy to help you through the process.