Table of Content

Why Supply Chain Security Matters?
The Scope of Your Supply Chain Obligations
Tiering Your Suppliers
Building a Third-Party Risk Management (TPRM) Program
The Cascading Effect: You Are Also a Supplier

Why Supply Chain Security Matters?

The statistics are sobering. Major cybersecurity incidents in recent years have repeatedly demonstrated that attackers don't need to breach your organization directly — they can exploit a trusted supplier to gain access.

High-profile supply chain attacks (like those affecting software build systems, managed service providers, and cloud platforms) have resulted in widespread compromise of hundreds of organizations simultaneously. NIS2 was partly designed in response to this growing threat.

Under NIS2, Article 21(2)(d) explicitly lists "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" as a mandatory security measure.

The Scope of Your Supply Chain Obligations

NIS2's supply chain obligations extend to direct suppliers and service providers with particular focus on:

ICT (Information and Communications Technology) suppliers — software, hardware, cloud services, network infrastructure
Managed Service Providers (MSPs) — organizations that manage your IT systems
Managed Security Service Providers (MSSPs) — outsourced security operations
Critical suppliers — any third party whose compromise could directly impact your ability to deliver essential services

The Directive also requires organizations to take into account the overall quality and resilience of products and services they procure — not just price and functionality.

Important:

ENISA (the EU Agency for Cybersecurity) has published coordinated risk assessments for specific supply chains (e.g., 5G networks, cloud computing). Organizations operating in those domains should reference these assessments.

Supplier Risk Assessment During Procurement

Before on-boarding any supplier with access to your systems, data, or networks, you must conduct a cybersecurity risk assessment. This should evaluate:

The supplier's own cybersecurity posture (certifications, policies, audit results)
The nature and scope of access they will have to your systems
The potential impact if that supplier were compromised or disrupted
The supplier's incident response and business continuity capabilities

Practical approach: Develop a standard Vendor Security Questionnaire (VSQ) that all new suppliers complete. Weight the assessment based on the criticality of the relationship.

Contractual Security Requirements

Security obligations must be embedded in contracts with your suppliers. This means including contractual clauses that address:

Minimum security standards the supplier must maintain
Right-to-audit clauses allowing you to assess their security controls
Incident notification obligations (requiring the supplier to notify you if they experience a breach that may affect you)
Data handling and processing requirements
Sub-contractor security requirements (flowing down obligations to their own supply chain)
Consequences for security failures (termination rights, indemnification)

Ongoing Monitoring and Review

Supplier risk is not static — it changes as suppliers evolve, as new vulnerabilities emerge, and as the nature of your relationship changes. NIS2 requires ongoing monitoring:

Annual reassessment of high-risk suppliers
Monitoring of security certifications (e.g., ISO 27001 renewal status)
Subscription to threat intelligence feeds covering major supplier platforms
Reviewing supplier security advisories and vulnerability disclosures

Managing Third-Party Access

Control how suppliers access your systems:

Implement privileged access management (PAM) for third-party access
Apply the principle of least privilege — give suppliers only the access they need, nothing more
Use time-limited access tokens for maintenance activities rather than permanent credentials
Log and monitor all third-party access to critical systems
Revoke access promptly when a supplier relationship ends

Software and Hardware Supply Chain

Beyond service providers, NIS2 also expects organizations to manage risks from the products they procure:

Prefer suppliers with security certification for their products (e.g., EU cybersecurity certification schemes under the EUCS or EUCC frameworks)
Monitor vendor security advisories for products in use
Apply security patches in a timely and tested manner
Assess the risks of using software or hardware from suppliers in geopolitically sensitive jurisdictions

Tiering Your Suppliers

With potentially dozens or hundreds of suppliers, a pragmatic approach is to tier suppliers by risk:

Assessment frequency table based on supplier criticallity
Tier	Description	Assessment Frequency
Critical	Direct access to core systems; breach would cause severe service disruption	Annually + after major changes
High	Significant data access or system integration; breach would be serious	Annually
Medium	Limited integration; breach would have moderate impact	Every 2 years
Low	No system access; minimal data handling	At on-boarding only

Apply the most rigorous controls and monitoring to most critical suppliers, and a proportionate level of scrutiny to others.

Building a Third-Party Risk Management (TPRM) Program

A comprehensive TPRM program for NIS2 compliance includes these components:

Governance: Assign ownership of TPRM to a specific role (e.g., CISO, Head of Procurement). Establish a supplier security policy approved by senior management.

Inventory: Maintain a complete, current inventory of all third-party relationships with access to your systems or data. Many organizations are surprised to discover how many suppliers have access they had forgotten about.

Assessment Process: Standardize how you assess new and existing suppliers. Use questionnaires, certifications, and where justified, on-site or remote audits.

Contractual Framework: Work with legal counsel to develop standard security addenda for supplier contracts. Ensure these are reviewed and updated to reflect NIS2 obligations.

Incident Response Integration: Ensure your incident response plan covers scenarios where a significant incident originates from a supplier. You are still responsible for reporting to CNCS even if the root cause lies with a third party.

Continuous Improvement: Regularly review and update your TPRM program based on incidents, near misses, and changes in the threat landscape.

The Cascading Effect: You Are Also a Supplier

If your organization provides services to other NIS2-covered entities, remember that you are part of their supply chain. They will be asking you to demonstrate your own cybersecurity posture. Having robust NIS2 compliance in place is increasingly becoming a commercial differentiator — and in some cases, a prerequisite for doing business with public sector and regulated industry clients.

Key Takeaway

Supply chain security is no longer an optional best practice — under NIS2, it is a mandatory compliance obligation with teeth. Organizations that fail to manage third-party risks not only expose themselves to significant financial and operational damage, but also face regulatory sanctions.

Start by mapping your critical suppliers, assessing the top risks, and embedding security requirements in your most important contracts. Build from there into a mature, continuous TPRM program.