NIS2 reaches telecom suppliers in two ways: through the operator’s contracts, and directly if your own business is a regulated type. Every provider of public electronic communications networks or services is in scope and must manage security risks from its direct suppliers. A medium-sized or larger managed service, cloud or data centre provider is also regulated in its own right.
This guide covers where operators sit, the contract route, direct scope, what operators ask for, high-risk suppliers, what to build, what the rules leave open, and a checklist.
| Route one: through the contract | Route two: in scope yourself | |
|---|---|---|
| Who it reaches | Any supplier to an operator | Medium-sized or larger MSPs, MSSPs, cloud, data centre and other Annex I or II types |
| Legal basis | Article 21(2)(d) and (3), binding on the operator | Articles 2 and 3, Annexes I and II, binding on you |
| Level of detail | The operator’s risk assessment | Article 21, plus Regulation (EU) 2024/2690 for MSP, cloud and similar providers |
| Who checks | The operator | Your competent authority |
| Incident reporting | To the operator, as the contract says | To your CSIRT or authority: 24 hours, 72 hours, one month |
Are telecom operators in scope of NIS2?
Yes, all of them. Providers of public electronic communications networks and publicly available electronic communications services are listed in Annex I, and Article 2(2)(a)(i) brings them in “regardless of their size”. Operators that are medium-sized or larger are essential entities (Article 3(1)(a) and (c)). Small and micro providers are important entities, unless a Member State identifies them as essential.
Telecom security used to sit in Articles 40 and 41 of the European Electronic Communications Code (Directive (EU) 2018/1972), which set security and incident notification requirements. NIS2 deleted them with effect from 18 October 2024 (Article 43) and brought the providers into its own framework (recital 92). Under recital 95, Member States can keep the telecom regulator as the competent authority.
How does NIS2 reach telecom suppliers through contracts?
Through Article 21. Supply chain security is one of the ten minimum measures, “including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” (Article 21(2)(d)). Article 21(3) requires the operator to take into account each direct supplier’s specific vulnerabilities, the quality of its products and cybersecurity practices, and the results of EU coordinated supply chain risk assessments.
The operator cannot discharge that by hoping. Recital 85 encourages it to build cybersecurity measures into supplier contracts. In practice it adds contract terms, sends questionnaires and reserves audit rights.
So the obligation is legally theirs and commercially yours. You are not regulated, you are assessed. The operator’s side is in NIS2 supply chain risk assessment, and what arrives on your desk is in how to answer a security questionnaire.
This route has one useful property: it is negotiable. You satisfy a commercial counterparty, not a regulator, and a clause you cannot meet is a negotiation, not an infringement.
When is a telecom supplier directly in scope of NIS2?
When your own business is a type of entity listed in Annex I or II and you are medium-sized or larger. This is the route people miss. Besides operators, Annex I lists managed service providers, managed security service providers, cloud computing, data centre and content delivery network providers, internet exchange points, and DNS, TLD and trust service providers, the last three regardless of size. Those are ordinary supplier businesses.
NIS2 defines a managed service provider as an entity providing services “related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems”, on the customer’s premises or remotely (Article 6(39)). Networks are in the definition. A company that runs network operations for an operator, or maintains its equipment, can fall within it. One that hosts a platform component is likely a cloud or data centre provider. The MSP rules are in NIS2 for MSPs and MSSPs.
If you sell connectivity yourself, you may be a public network or service provider, and then size does not matter.
Does size keep you out?
Only if you are a small or micro enterprise: fewer than 50 staff, and annual turnover or balance sheet total of €10 million or less (Recommendation 2003/361/EC). Figures of partner and linked enterprises, such as your group, generally count too, so a 40-person supplier inside a large group can be in scope. A medium-sized MSP or cloud provider is an important entity; above the medium-sized ceilings it is essential.
Why is route two more prescriptive?
For MSP, MSSP, cloud, data centre, CDN, DNS, TLD and trust service providers, and some online platforms, Implementing Regulation (EU) 2024/2690 (adopted 17 October 2024, in force since 7 November 2024) sets technical and methodological requirements in 13 annex sections. It also defines when an incident at those providers is significant, which starts the Article 23 reporting clock.
Here the usual pattern reverses. The telecom operator is not covered by that regulation: it gets Article 21’s ten measures, read through its national law. An MSP or cloud provider gets a specification. Less room to interpret, and less room to under-do it. The benefit: you can build and demonstrate against it, rather than argue proportionality after the fact. An MSP or cloud provider is supervised where its main establishment is (Article 26(1)(b)), which may not be the operator’s country.
What if you sell products rather than services?
Selling a box or a licence generally does not make you a managed service provider. Network equipment and software are generally products with digital elements under the Cyber Resilience Act (Regulation (EU) 2024/2847). Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours; the main obligations apply from 11 December 2027. See the CRA reporting duty.
Unsure which route you are on? The NIS2 scope checker takes a couple of minutes.
What will telecom operators ask their suppliers for?
On either route, operator procurement asks for much the same things. This is practice, not a legal list.
Evidence, not assertions. Increasingly the clause asks for a certificate or an audit report rather than a completed questionnaire, and ISO 27001 is what is usually named. Regulation 2024/2690 lists audit rights or audit reports among the points supplier contracts should cover: not binding on operators, but an obvious template.
Incident notification to them, on a clock. An operator must send an early warning within 24 hours of becoming aware of a significant incident (Article 23). Their clock starts when they learn, and they often learn from you. Agree the path and the timescale in the contract, not during an incident.
Sub-supplier visibility. Article 21 covers direct suppliers, but recital 85 says entities “could consider” risks from other levels of the supply chain, and many operators do. Expect to name your own critical suppliers and subcontractors.
Encryption and access specifics. Telecom procurement asks harder questions than most sectors on encryption in transit and administrative access to systems carrying customer traffic. See encryption under NIS2 in telecom.
Where your components come from. That question has a policy history of its own.
What do high-risk suppliers and the 5G Toolbox mean for suppliers?
Commission Recommendation (EU) 2019/534 of 26 March 2019 led to a coordinated EU risk assessment of 5G networks in October 2019. On 29 January 2020 Member States, through the NIS Cooperation Group, adopted the EU Toolbox of risk-mitigating measures. They committed to restrict suppliers considered high risk, including exclusions from key assets such as core network functions, and to diversify vendors. Member States apply it through national measures.
NIS2 builds on this: recital 90 names the 5G assessment as the model for coordinated supply chain risk assessments under Article 22, whose results operators must take into account (Article 21(3)).
On 20 January 2026 the Commission proposed a revised Cybersecurity Act (COM(2026) 11). Under it, operators of electronic communications networks could not rely on high-risk suppliers for their critical assets, with a transition period of up to 36 months for mobile networks. It is a proposal only: the European Parliament and the Council must agree it, and it may change.
For a supplier, the effect arrives before any law does. Expect operators to ask what is inside your offer and who made it: cheap to answer from a maintained component inventory, expensive from scratch.
What should a telecom supplier build?
The same thing on both routes, which is the useful part: an ISO 27001 aligned management system scoped to the services you provide to operators, with Article 21 mapped onto it, and the 2024/2690 annex if it applies. Then three additions:
- Decide your route explicitly and write down why. Customers, insurers and possibly an authority will ask. A reasoned answer on file is worth an afternoon.
- Treat the notification path as a control. Who tells the customer, how fast, through which channel, with what information. Most suppliers have this nowhere.
- Keep the sub-supplier register current. You cannot answer that question quickly if you have not maintained it.
A one-page record for all three:
NIS2 SUPPLIER POSITION RECORD
Services provided to telecom operators: ...
Size with group data (staff, turnover, balance sheet): ...
Route decision
Directly in scope? yes / no
Entity type (Annex I/II): e.g. managed service provider
Size category: small (out) / medium / large
Main establishment: ...
Competent authority: ...
Reasoning, date, approver: ...
Operator-facing evidence pack
Certificate or audit report: scope, issuer, expiry date
Incident notification: contact, channel, timescale per contract
Sub-supplier register: name, service, access held, review date
Component inventory: product, manufacturer, originWhat does NIS2 leave open for a telecom supplier?
Regulation 2024/2690 goes into far more detail than Article 21, and it is still a specification of what must exist rather than a test of whether it works.
Its annex asks for vulnerability handling, monitoring and logging, and backups. Each can be satisfied by a documented procedure and a record that it ran. A monthly scan report satisfies the vulnerability requirement while critical findings age. Log retention satisfies logging while nobody queries the logs. A tested backup satisfies continuity while nobody has timed a full restore against the recovery objective in the contract.
That gap matters more for a telecom supplier, because on the other side of your interface is a network other companies depend on. If a problem in your systems reaches the operator’s, the question afterwards is how long it was there before anyone noticed.
The investment that pays is not a thicker compliance file. It is continuous detection and exposure management on the systems that touch the operator’s, with findings that carry an owner and a deadline, and evidence that accumulates as it happens. That is the approach of the CloudSoul platform: automated evidence collection, with human-in-the-loop expertise for the judgement calls. A security audit shows how far you are from what the next contract renewal will ask. The wider programme is on the NIS2 page, the sector view on the IT and telecom page.
NIS2 checklist for telecom suppliers
- Decide whether you are directly in scope, using group figures for size, and record why.
- If in scope, identify your main establishment, authority and registration duty.
- Map your controls to Article 21 and, if it applies, the 2024/2690 annex.
- Agree the incident notification path and timescale with each operator.
- Keep a register of your own critical suppliers and subcontractors.
- Keep an inventory of the components you supply and who made them.
- Prepare one reusable evidence pack for operator questionnaires and audits.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 6, 21, 22, 23, 26 and 43, Annexes I and II, and recitals 85, 90, 92 and 95, EUR-Lex.
- Directive (EU) 2018/1972 (European Electronic Communications Code), EUR-Lex.
- Commission Implementing Regulation (EU) 2024/2690, Article 16 and Annex, EUR-Lex.
- Commission Recommendation 2003/361/EC, SME definition, EUR-Lex.
- Commission Recommendation (EU) 2019/534 on cybersecurity of 5G networks, EUR-Lex.
- European Commission, press release on the EU toolbox for 5G security, 29 January 2020, IP/20/123.
- European Commission, proposal for a revised Cybersecurity Act, COM(2026) 11, EUR-Lex; press release of 20 January 2026, IP/26/105; Cybersecurity package questions and answers.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex; European Commission, Safer and more secure digital products, 11 September 2026.
Frequently asked questions
Does NIS2 apply to suppliers of telecom operators?
In two ways. Telecom operators are in scope regardless of size and must manage security risks from their direct suppliers under Article 21(2)(d) and (3), so requirements reach suppliers through contracts. A supplier is also directly in scope if its own business is a listed type, such as a managed service, cloud or data centre provider, and it is medium-sized or larger.
Are telecom operators essential or important entities under NIS2?
Providers of public electronic communications networks or publicly available electronic communications services are in scope regardless of size. Medium-sized and larger providers are essential entities. Small and micro providers are important entities unless a Member State identifies them as essential.
Is a company that manages an operator's network regulated by NIS2 itself?
It can be. NIS2 defines a managed service provider as one providing services related to the installation, management, operation or maintenance of ICT products, networks or infrastructure, on site or remotely. A managed service provider that is medium-sized or larger is directly in scope, and Implementing Regulation (EU) 2024/2690 sets detailed security requirements for it.
What happened to the telecom security rules in the European Electronic Communications Code?
NIS2 deleted Articles 40 and 41 of the European Electronic Communications Code, which set security and incident notification requirements for telecom providers, with effect from 18 October 2024. Those providers now fall under NIS2 instead.
Will telecom operators have to stop using high-risk suppliers?
There is no EU-wide rule yet. Under the 2020 5G Toolbox, Member States committed to restrict high-risk suppliers for key assets through national measures. The Commission's January 2026 proposal to revise the Cybersecurity Act would stop network operators relying on high-risk suppliers for critical assets, but it is still a proposal.
