Does NIS2 affect me if my client is in scope?

Indirectly, yes. Article 21 of NIS2 asks regulated entities to take the security of their suppliers into account. A client subject to the directive will therefore probably ask you for evidence: contract clauses, questionnaires, proof of measures, a commitment to report your incidents. That alone does not bring you into the directive’s scope; your own activity and size determine whether you are directly in scope. If in doubt about your situation, your legal counsel is the right person to ask.

This article takes the supplier’s point of view. For the client side, see Are my suppliers subject to NIS2?. For the general method, see Who does NIS2 apply to?.

First, check you are not directly in scope

Before thinking about knock-on effects, check your own status. This matters most if you are:

• a managed service provider (MSP) or MSSP: “ICT service management” is listed in Annex I. Under the directive’s size criteria, entities in this sector with 50 or more staff generally fall among important entities;
• a hosting, cloud or data centre provider: also Annex I;
• a manufacturer of electrical or electronic equipment, machinery or medical devices: Annex II.

In these cases, the directive may apply to you directly, on top of the requests your clients pass on. The exact classification depends on your activity and size, and is worth checking with your legal counsel.

Why your client will come to you

Article 21 of Directive (EU) 2022/2555 provides that regulated entities manage supply chain security, taking into account each direct supplier’s specific vulnerabilities and cybersecurity practices. Article 20 makes their management bodies accountable for this, which is why your client will look for evidence from you.

Article 23 also provides for an early warning within 24 hours for significant incidents at regulated entities. If an incident on your side could affect your client, it will want to hear about it very quickly.

What you will probably be asked for

Request	What it usually covers
Security questionnaire	Governance, access management, multi-factor authentication, patching, backups, incident handling
Contract clauses	Minimum measures, incident notification deadline, audit rights, onward subcontracting, confidentiality
Evidence	Security policy, audit results, any certification, attestations
Point of contact	A named contact for security and incidents

Requirements are proportionate to how critical you are to the client. A supplier with access to its systems or hosting its data will face more questions than an office supplies vendor.

How to prepare without spreading yourself thin

1. Take stock of the measures you already have, even informal ones. You probably have more than you think.
2. Build a standard security pack you can share with every client, instead of answering each request from scratch.
3. Put incident detection and response in place. It is the most common requirement and the hardest to improvise: knowing an incident is happening, and telling your client within the agreed time.
4. Read the clauses before signing. An unrealistic notification deadline or unlimited audit rights can be negotiated.

A constraint, but also a sales argument

Regulated organisations will favour suppliers that can prove their security level. A solid pack shortens sales cycles and sets you apart in tenders. SMEs in this position will find more guidance in NIS2 SMEs: does NIS2 apply to small and medium-sized businesses?.

Talk to an expert

A client is asking you to prove you can detect and report an incident? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch and we will connect you with a partner.

Frequently asked questions

Can my client require me to report incidents within a few hours?

It can ask, and it fits with its own 24-hour deadline. Before signing, it is worth checking that the deadline can actually be met, including nights and weekends.

Do I need a certification to keep working with a regulated client?

The NIS2 text does not set a certification requirement for suppliers of regulated entities. Some clients will ask for one, others will accept evidence of measures. A clear security pack is often enough for non-critical suppliers.

Are my own suppliers affected in turn?

Indirectly, it can happen: if your client asks you to control your subcontracting, you are likely to pass some of its requests down. See Are my suppliers subject to NIS2?.

What if I supply several regulated clients with different requirements?

A common approach is to organise the security pack around the measures listed in NIS2 Article 21, which most client requirements derive from. Each client can then be answered by mapping its questions to the existing pack, rather than starting again each time.

Can my client terminate the contract if I do not comply?

That depends on the contract and is a question for your legal counsel. Contracts with regulated entities increasingly include security clauses, sometimes with termination rights. This is another reason to read clauses carefully before signing.

Should I tell my client about every incident?

Not necessarily. Contracts generally specify which incidents must be reported, often those that could affect the client's data, systems or services. Clear criteria avoid both silence and noise.