Are my suppliers subject to NIS2?

Not automatically. A supplier is only subject to NIS2 if it meets the sector and size criteria itself, such as an MSP or a cloud provider that reaches the size thresholds. However, for organisations in scope, Article 21 of NIS2 lists supply chain security among the expected measures: in practice, they assess their suppliers’ security and address it in their contracts.

This article takes the regulated entity’s point of view. If you are the supplier, read Does NIS2 affect me if my client is in scope? instead. For the general method, see Who does NIS2 apply to?.

Two separate questions

Two topics are often mixed up.

1. Is your supplier regulated in its own right? It is if its activity is listed in the directive’s annexes and it exceeds the size thresholds. Several common providers are directly covered by Annex I:

• managed service providers (MSPs) and managed security service providers (MSSPs);
• cloud computing and data centre service providers;
• electronic communications providers and DNS providers.

An accountancy firm, a web agency or a local haulier generally is not.

2. Does NIS2 address the risk it represents? For entities in scope, Article 21 covers supply chain security, whether or not the supplier is itself regulated.

What NIS2 says about the supply chain

Article 21 of Directive (EU) 2022/2555 lists, among the cybersecurity risk management measures, “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” (paragraph 2, point d).

Paragraph 3 adds that entities take into account:

• the vulnerabilities specific to each direct supplier and service provider;
• the overall quality of their products and cybersecurity practices, including their secure development procedures.

Key point: the directive frames these measures as the regulated entity’s own. Article 20 provides that management bodies approve the cybersecurity risk management measures and oversee their implementation, and supply chain security is one of those measures. How this applies to a specific organisation is a question for its legal adviser.

In practice: a five-step approach

1. Map your direct suppliers and service providers, starting with those that access your systems or host your data.
2. Rank each supplier by criticality: what happens to your business if it is compromised or unavailable?
3. Check the NIS2 status of your critical suppliers. A regulated supplier has its own obligations, which builds confidence but is no guarantee.
4. Contract for security. Contracts commonly address minimum measures, prompt notification of incidents that affect you, audit or evidence rights, conditions for onward subcontracting, exit and reversibility.
5. Review over time: annual review of critical suppliers, updated clauses, tests of the notification process.

Your MSP is a special case

Your managed service provider often has broad access to your systems. If it reaches the size thresholds, it falls within a sector listed in Annex I and may be in scope in its own right; its exact status depends on the national transposition. It is also a natural ally in putting technical measures in place, especially incident detection and handling.

For the MSP perspective, see NIS2 Directive: obligations, risks and growth levers.

Common mistakes

• Sending the same questionnaire to 200 suppliers. Focus effort on critical suppliers.
• Treating a certification as the only proof. ISO 27001 is a good signal, but NIS2 does not require it: what counts is the measures actually in place.
• Forgetting notification. Article 23 of NIS2 provides for an early warning within 24 hours of becoming aware of a significant incident. If the incident starts at a supplier and nothing provides for the supplier to inform you quickly, that deadline is hard to meet.

Talk to an expert

Want to know how your providers contribute to incident detection? Cyna’s certifications and security documents are available on its Trust Center. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Do I need to audit every supplier?

The directive does not ask for that: it describes risk-based, proportionate measures. Many organisations focus audits and evidence requests on critical suppliers and rely on standard clauses and a self-declaration for the rest.

Can I impose NIS2 on a supplier that is not subject to it?

The law cannot be imposed on it, but contracts commonly include proportionate security requirements. Article 21 of NIS2 refers to the security aspects of relationships with direct suppliers; your legal adviser can help assess what fits your situation.

What if a critical supplier refuses to commit?

Record the risk, look for compensating measures on your side (segmentation, closer monitoring of its access) and consider an alternative in the medium term. What matters is being able to show the risk was identified and handled.

Are non-EU suppliers covered?

Article 21 refers to direct suppliers without distinguishing by country. Article 26 of NIS2 also provides that certain non-EU digital service providers offering services in the EU designate a representative there.

Where do I start if I have hundreds of suppliers?

Start from your systems, not your supplier list: who has remote access, who hosts data, who manages infrastructure. That usually brings the critical list down to a manageable number.