NIS2 supply chain security: what essential and important entities must do about their suppliers

What does NIS2 require on supply chain security?

Article 21(2) lists the measures every essential and important entity must include at a minimum, and point (d) names supply chain security, "including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers". Like the other measures, it must be appropriate and proportionate to the risks, on an all-hazards basis.

Article 21(3) then says what the assessment must weigh. You take into account the vulnerabilities specific to each direct supplier and service provider, and the results of the coordinated security risk assessments of critical supply chains that the Directive provides for. Article 21(4) closes the loop: where you find a shortfall, corrective measures follow without undue delay.

The Directive sets the outcome, not a checklist. The other nine measures are covered in the ten Article 21 measures, one at a time. This guide explains the texts, not legal advice; your national law and competent authority decide how they apply to you.

Essential and important entities: same duty, different supervision

Article 21 applies to both categories without distinction, so a mid-sized food manufacturer classed as important must manage its suppliers to the same standard of appropriateness as a large energy operator classed as essential. Proportionality, not category, adjusts the depth. Working out which category you are in is covered in Essential or important? The scope and size rules.

The difference is in how the authority checks. Under Article 32, supervisors of essential entities can inspect on site, run regular and targeted security audits, carry out security scans, request information and ask for evidence that measures are in place. Under Article 33, important entities are supervised after the fact, when the authority has evidence or an indication that they may not comply. A supplier-caused incident is exactly such an indication, so keep the same evidence either way.

Turning the article into a working supplier programme

The steps below are Sterling's recommended approach, built on the Directive's wording and on the way ISO/IEC 27036, the ISO family on supplier relationships, structures the subject.

1. Know who your direct suppliers are

Start with a register of every direct supplier and service provider that touches your network and information systems or the physical environment around them: cloud and hosting providers, managed service and managed security service providers, software vendors, telecoms carriers, maintenance contractors with remote access and outsourced development teams.

2. Rate each supplier's criticality

Ask what the supplier can reach, what would stop if it failed and how quickly you could replace it. Sterling's recommended classification uses three tiers, critical, significant and standard, so that effort goes where Article 21(3) points it; the tiers are a working method, not terms from the Directive.

3. Assess proportionately

For critical suppliers, look at their incident history, secure development practice, access model, sub-suppliers and any independent evidence such as an ISO/IEC 27001 certificate or a SOC 2 report, checking that its scope covers the service you use.

4. Put security into the contract

Clauses should cover security requirements, incident notification fast enough for your own 24-hour early warning, audit or evidence rights, sub-contracting, data return at exit and vulnerability handling. Your reporting clock is explained in NIS2 incident reporting: 24 hours, 72 hours, one month.

5. Review, and act on what you find

Reassess critical suppliers at planned intervals and after a change of service, an incident or a merger. Record findings, agree remediation and, where a supplier cannot close a gap, decide on compensating controls or an exit plan, as Article 21(4) expects.

A worked example: a water utility and its suppliers

Take a large drinking water company in Portugal, an Annex I entity and therefore essential. Its register lists 140 suppliers. Twelve are rated critical, among them the managed service provider that runs its IT, the vendor that maintains its control systems remotely, its cloud backup provider and its telecoms carrier. Each of the twelve receives a structured assessment, a contract addendum with a notification period shorter than 24 hours and an annual review. The rest answer a questionnaire or sign standard security terms.

The management body approves the policy and tiering and receives a quarterly summary of open supplier actions. When the authority asks for evidence, the company hands over the register, ratings, assessments, clauses and action log. The same pattern scales down for an important entity with a few dozen suppliers.

Cloud, managed service and other digital providers

Some of your suppliers are NIS2 entities themselves. Commission Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements of the Article 21(2) measures for digital providers such as DNS, cloud, data centre, managed service and managed security service providers. Section 5 of its Annex is headed "Supply chain security", so these providers must run a supplier programme of their own, and they fall under the Member State of their main establishment in the Union under Article 26. The detail is in Implementing Regulation (EU) 2024/2690 explained.

A cloud or managed service provider that is regulated in its own right is a stronger supplier to rely on, but it does not remove your duty. You still rate it, contract with it and review it, because Article 21(3) looks at the relationship from your side. ENISA's technical implementation guidance of June 2025 maps the Regulation's requirements to ISO/IEC 27001:2022 and ISO/IEC 27002:2022, and ENISA states that following it does not by itself establish compliance.

When you are the supplier to an EU entity

A software house in India, a BPO in the Philippines or a start-up in the United States may fall outside NIS2 altogether and still feel it. Their EU customers must show that supplier risk is managed, so questionnaires, security schedules and audit rights arrive with renewals.

Check first whether the Directive reaches you directly. Providers of the digital services listed in Article 26(1)(b), such as cloud, data centre and managed service providers, that offer services in the Union without being established there must designate a representative in a Member State where they offer services. The regional pages, including NIS2 for suppliers in India and NIS2 for suppliers in the Philippines and South East Asia, cover typical customer requests.

Where supplier programmes go wrong

• Questionnaires with no follow-through. Answers are filed and never scored, so a critical supplier's weak incident process goes unnoticed until it matters.
• Treating a certificate as the assessment. An ISO/IEC 27001 certificate helps only if its scope covers the service you receive; many cover a head office, not the delivery centre.
• Contracts that miss the clock. A supplier allowed 72 hours to tell you about a breach makes your own 24-hour early warning impossible.
• The board never sees it. Article 20 makes the management body approve and oversee the measures, suppliers included.

NIS2 supply chain security: questions buyers ask