NIS2 supply chain security: what you need to know

Introduction

One of the most discussed aspects of NIS2 is the requirement for supply chain security. "How deep do I need to go in vetting my suppliers?" is a question that concerns many organizations.

What Does NIS2 Require Regarding Supply Chain?

Article 21 - Explicit Requirements:

Essential and important entities must take measures for:

1. Security of procurement, development, and maintenance of systems
2. Vulnerability management and disclosure policies
3. Supply chain security - including security aspects of relationships with direct suppliers

What Does This Mean in Practice?

You don't need to audit every supplier in the world, but you must:

• Identify suppliers critical to your operations
• Assess risks associated with these suppliers
• Include security requirements in contracts
• Monitor compliance of critical suppliers

Defining Critical Suppliers

Assessment Criteria:

1. System Access - Does the supplier have access to your IT infrastructure?
2. Data Access - Does the supplier process sensitive data?
3. Operational Dependency - What happens if the supplier is unavailable?
4. Uniqueness - Are there alternatives in the market?
5. Incident Impact - What would happen if the supplier is compromised?

Categories of Critical Suppliers:

Level 1 - Critical:

• Cloud infrastructure providers
• Managed Service Providers (MSP)
• Custom software developers
• Cybersecurity providers

Level 2 - Important:

• Commercial software providers
• IT support services
• Network equipment suppliers
• Consultants with system access

Level 3 - Standard:

• Office service providers
• Consumables suppliers
• External services without system access

Practical Implementation Measures

1. Supplier Inventory

Create a registry that includes:

• Supplier name
• Services provided
• Access level (systems, data)
• Criticality classification
• Date of last assessment

2. Due Diligence for New Suppliers

Before contracting, verify:

• Security certifications (ISO 27001, SOC 2)
• Security incident history
• Security policies
• Business continuity plan
• Cyber liability insurance

3. Security Contractual Clauses

Include in contracts:

• Minimum security obligations
• Right to audit
• Incident notification obligation
• Continuity requirements
• Termination clauses for non-compliance

4. Continuous Monitoring

For critical suppliers:

• Periodic assessments (annual or more frequent)
• Certification monitoring
• Review of published incidents
• Access and permission reviews

Specific Challenges

Global Suppliers

Many organizations depend on international suppliers (AWS, Microsoft, Google). For these:

• Verify NIS2 compliance (many already have it)
• Analyze data processing agreements
• Evaluate EU data residency options
• Document due diligence performed

Small Suppliers

Smaller suppliers may not have formal certifications. In this case:

• Request completion of a security questionnaire
• Evaluate basic practices (backup, access, updates)
• Consider risk and mitigate it contractually

Open Source Software

While not a traditional "supplier," open source components require attention:

• Maintain an inventory (SBOM)
• Monitor vulnerabilities
• Promptly update critical components
• Evaluate project maintenance

Required Documentation

For DNSC and Audits:

1. Supplier Management Policy

   • Assessment criteria
   • Approval process
   • Review frequency

2. Critical Supplier Registry

   • Updated list
   • Risk classifications
   • Mitigation measures

3. Assessment Records

   • Completed questionnaires
   • Verified certifications
   • Action plans

4. Standard Contractual Clauses

   • Security annex templates
   • Data processing agreements
   • Relevant SLAs

How NIS2 Manager Helps

Supplier Management Module (In Development):

• Centralized supplier inventory
• Automatic criticality classification
• Reminders for periodic assessments
• Document and certification storage
• Audit reports

Integration with Gap Analysis:

• ID.SC control (Supply Chain Risk Management)
• Requirement implementation verification
• Gap identification

80% of Critical Entities Are Behind

A recent study shows that 80% of companies defined as critical infrastructure under the NIS2 directive do not yet meet NIS2 risk management and compliance requirements, including those for supply chain.

This represents both a challenge and an opportunity: organizations that get their supplier management in order now will have an advantage over competitors.

Conclusion

Supply chain security doesn't mean auditing every supplier, but intelligently managing risks. Focus on critical suppliers, document processes, and include security in procurement decisions.

NIS2 doesn't require perfection, but demonstrating a mature and documented process for managing supply chain risks.

Start evaluating supply chain controls

NIS2 Manager is a product by BetterQA, one of Europe's top software testing companies.