Supply chain: articles and guides.
Every CloudSoul article on Supply chain, newest first.
Security annex in supplier contracts: what each clause asks for, and how to answer it
A security annex turns your customer's security requirements into contract terms with a clock, an audit right and a consequence. Its core is usually the eight supplier contract points in Regulation (EU) 2024/2690. Ten clauses, what each costs, what to negotiate, and a checklist.
Ground segment security: what a satellite operator checks before giving a supplier access
Before a supplier gets into a ground segment, the operator checks who will have access, how they connect and what that access can reach. The six areas of the review, where they come from under NIS2, the EU Space Act proposal, and what to build first.
Cybersecurity requirements for space suppliers: NIS2, the proposed EU Space Act, ESA and prime contractors
Most space suppliers get cybersecurity requirements through customers, not regulators. What NIS2 covers in the space sector, what the proposed EU Space Act would add, what ESA, EU programme and prime contracts ask, which comes first, and what to build once.
NIS2 for telecom suppliers: the two ways the obligations reach you, and what operators will ask for
NIS2 reaches telecom suppliers in two ways: through the operator's contracts, because operators must manage direct supplier risk, and directly if you are a medium-sized or larger MSP, cloud or data centre provider. Both routes, what operators ask for, what to build.
CRA reporting obligations: what manufacturers must report since 11 September 2026, to whom and how fast
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents in their products: early warning in 24 hours, notification in 72 hours, then a final report. What counts, who receives it, and how NIS2 fits.
EASA Part-IS explained: who it applies to, the deadlines, and what it means for aviation suppliers
EASA Part-IS requires aviation organisations to run an ISMS for information security risks to aviation safety. It has applied since 16 October 2025 or 22 February 2026, depending on the organisation. Who is in scope, what it requires, the NIS2 overlap and what suppliers must do.
NIS2 supply chain security: how to assess supplier risk under Article 21
NIS2 makes supply chain security one of the ten minimum measures. You must assess each direct supplier's vulnerabilities, product quality and security practices, and take EU coordinated assessments into account. The steps, the contract clauses and what Article 22 adds.
NIS2 manufacturing: which manufacturers are in scope (NACE C26 to C30 and medical devices)
NIS2 covers makers of medical devices and IVDs and of products in NACE Rev. 2 divisions 26 to 30, from 50 staff or over EUR 10 million turnover and balance sheet. What each division covers, automotive suppliers, car dealers, status and duties.
NIS2 for MSPs and MSSPs: are managed service providers in scope, and what applies?
Managed service providers and managed security service providers are an Annex I sector under NIS2. If you are medium-sized or larger, you are in scope: important if medium, essential if large. What applies, which country supervises you, what to register and report.
NIS2 for transport: which air, rail, water and road operators are in scope and what applies
NIS2 covers transport operators of an Annex I type that are at least medium-sized: air carriers, airports, air traffic control, rail, shipping, ports, VTS, road authorities and ITS operators. Who is in and out, essential or important, and how Part-IS, ISPS and CER fit.