NIS2 supply chain security: how to assess supplier risk under Article 21

NIS2 makes supply chain security one of the ten minimum measures in Article 21(2)(d). When you decide on those measures, you must take into account the risk each direct supplier and service provider brings: its specific vulnerabilities, the quality of its products and security practices, including secure development, and the results of EU coordinated risk assessments (Article 21(3)). Those EU assessments, under Article 22, are a separate exercise run by the Cooperation Group, the Commission and ENISA.

This guide covers what NIS2 requires, who counts as a supplier, the assessment steps, what goes in the contract, how often to review, what Article 22 adds, what changes if you are the supplier, and a checklist.

Step	What to do	Where it comes from
1. Register	List every direct supplier and service provider and what they provide	Article 21(2)(d); point 5.2 of the annex to Regulation 2024/2690
2. Classify	Rank them by how much your services depend on them	Article 21(1), proportionality
3. Assess	Check vulnerabilities, product quality, security practices and secure development	Article 21(3)
4. Contract	Put security requirements, incident notification and audit rights in writing	Recital 85; point 5.1.4 of the annex
5. Review	Re-check at planned intervals and after changes or incidents	Points 5.1.6 and 5.1.7 of the annex
6. Align	Take EU coordinated assessments into account	Articles 21(3) and 22

What does NIS2 require for supply chain security?

Supply chain security is one of the ten Article 21 measures, and the text is short. Article 21(2)(d) requires “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”.

Article 21(3) says what “appropriate” means here. When deciding on supply chain measures, you must take into account:

• the vulnerabilities specific to each direct supplier and service provider;
• the overall quality of their products and cybersecurity practices, including their secure development procedures;
• the results of coordinated security risk assessments of critical supply chains carried out under Article 22(1).

“Each” matters. A single generic questionnaire sent to every vendor does not show that you considered each supplier’s specific vulnerabilities.

Who counts as a supplier under NIS2?

NIS2 does not define “supplier”. The text speaks of your direct suppliers and service providers, and it is not limited to ICT. A practical starting point is anyone who provides you with ICT products or services, or who has access to your systems, then anyone else whose failure would affect the services in scope. Recital 85 gives examples: providers of data storage and processing services, managed security service providers and software editors. It encourages entities to write cybersecurity measures into their contracts with direct suppliers, and says entities “could consider” risks from other levels of the supply chain.

Recital 86 singles out managed security service providers, which do incident response, penetration testing, security audits and consultancy. Because they are closely integrated in your operations, it asks for “increased diligence” when you select one. Many of them are regulated themselves, as explained in NIS2 for MSPs and MSSPs.

How do you run a NIS2 supplier risk assessment?

Proportionately. A cleaning contractor and your cloud provider do not get the same treatment.

1. Build the register. Every direct supplier and service provider, with a contact point and the ICT products, services or processes they provide. Implementing Regulation (EU) 2024/2690 requires exactly this of the providers it covers, and it is a sensible baseline for everyone.
2. Classify by dependency. Which suppliers could stop a service in scope, reach your data, or hold privileged access? Those are your critical suppliers.
3. Assess, in proportion. Every direct supplier is considered; the depth depends on how critical it is. For critical suppliers, look at known vulnerabilities and incident history, the quality and resilience of what it sells, its security practices and how it develops software. A current ISO 27001 certificate with a relevant scope, or a SOC 2 report, answers part of this. It does not answer questions specific to your use of the service.
4. Decide and record. Accept, mitigate (contract clauses, extra controls on your side, a second supplier) or replace. Write down why.
5. Plan for failure. For each critical supplier, what happens if it is breached or disappears? The implementing regulation lists the ability to diversify sources of supply and limit vendor lock-in as a selection criterion.

What should supplier contracts say?

Implementing Regulation (EU) 2024/2690 applies to DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers. For them, point 5.1.4 of its annex lists what contracts with suppliers must specify, where appropriate:

• cybersecurity requirements for the supplier, including for the ICT products or services it provides;
• requirements on awareness, skills, training and, where appropriate, certifications of its staff;
• background verification of its staff;
• an obligation to notify you, without undue delay, of incidents that present a risk to your systems;
• the right to audit, or to receive audit reports;
• an obligation to handle vulnerabilities that present a risk to your systems;
• rules on subcontracting, with the same security requirements for subcontractors;
• obligations at the end of the contract, such as returning and disposing of your information.

If you are not one of those providers, this list is not binding on you, but it is the most concrete official reading of Article 21(2)(d) there is. An authority will recognise it.

How often do you need to review suppliers?

At planned intervals, and when something significant changes. For the providers it covers, the implementing regulation requires reviewing the supply chain policy and acting on changes in suppliers’ cybersecurity practices when there are significant changes to operations or risks, or significant incidents involving a supplier. That includes monitoring service level reports, reviewing supplier-related incidents and analysing the risk of changes to what suppliers provide.

In practice: critical suppliers once a year and on any trigger event, such as a breach, an acquisition or a new subcontractor. Others on a longer cycle.

What is an EU coordinated supply chain risk assessment?

This is Article 22, and it is not something you carry out. The Cooperation Group, in cooperation with the Commission and ENISA, may carry out coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products supply chains. The Commission identifies which ones, after consulting the Cooperation Group and ENISA.

The recitals describe the model. The 5G assessment carried out after Commission Recommendation (EU) 2019/534 is the template (recital 90). The assessments look at technical and non-technical risk factors. Non-technical factors include “undue influence by a third country on suppliers and service providers”, concealed vulnerabilities or backdoors, and supply disruption from technological lock-in or provider dependency. To choose which supply chains to assess, recital 91 lists criteria such as how much entities rely on a product, whether alternatives exist, and how resilient the supply chain is.

Your obligation is to take the results into account (Article 21(3)). If an assessment covers a product you depend on, your risk register and your supplier decisions should show that you read it.

The Commission proposed a wider framework in January 2026. The Cybersecurity Act revision would set up an EU framework for trusted ICT supply chain security. Under it, operators of electronic communications networks could not rely on high-risk suppliers for their critical assets. It is a proposal and not yet law.

What changes if you are the supplier?

If your customers are in scope, NIS2 reaches you through them, even if you are not regulated yourself. Expect more security questionnaires, security clauses in contracts, requests for audit reports and incident notification commitments. Answering once, with evidence you can reuse, is cheaper than answering each questionnaire from scratch. How to answer a security questionnaire covers the method. If your customers ask for proof of an information security management system, ISO 27001 vs NIS2 shows how far a certificate goes.

Where supplier risk programmes go wrong

A supplier programme usually fails in the same way: a spreadsheet of questionnaire answers from a year ago. Those answers describe what the supplier said, not what is true today. The supplier that changed its hosting provider, lost its security lead or suffered a breach last month still shows green.

The fix is to hold less paper and more signals. Keep the register current by linking it to procurement and finance, so new suppliers appear automatically. Track the few facts that change risk: certificate expiry dates, disclosed breaches, access that suppliers still hold in your systems. Review the exceptions with a person, not the whole list. That is the approach the CloudSoul platform takes to evidence. To find out where your own supply chain stands against NIS2, start with a security audit. The wider programme is on the NIS2 compliance page.

NIS2 supply chain checklist

• Keep a register of all direct suppliers and service providers, with what each provides.
• Identify the critical ones by dependency, data access and privileged access.
• Consider every direct supplier, and assess the critical ones in depth: vulnerabilities, product quality, security practices.
• Add security requirements, incident notification, audit rights and exit clauses to critical contracts.
• Review critical suppliers at least yearly and after any significant change or incident.
• Record a continuity plan for the loss or compromise of each critical supplier.
• Check whether any EU coordinated assessment covers products you depend on.
• Apply increased diligence when selecting a managed security service provider.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 21 and 22 and recitals 85, 86, 90 and 91, EUR-Lex.
• Commission Implementing Regulation (EU) 2024/2690, Annex, section 5, EUR-Lex.
• European Commission, Cybersecurity package questions and answers, 20 January 2026, Shaping Europe’s digital future.

Frequently asked questions