NIS2 & Third-Party Risk Management: From contracts to effective supplier control

The new oneNIS2 Directive (Directive (EU) 2022/2555)andtheir national implementation (Law implementing the NIS-2 Directive)mark a turning point for strategic corporate management. Cybersecurity is no longer a purely technical IT problem;key business risk, for which theManagement is held personally responsible. A particularly critical aspect is thisSupply chain security, as attacks via third-party providers (“supply chain attacks”) are increasing massively and can threaten the existence of entire facilities.

The new responsibility of management

According to Section 38 of the Act Implementing the NIS-2 Directive, management bodies of particularly important and important entities must approve the risk management measures under Section 30 BSIG and monitor their implementation.

• Personal liability:In the event of a culpable breach of these obligations, members of management can be held liable to their entity for the resulting damage.
• Training requirement:In order to be able to assume this responsibility, management mustregularly attend training courses,to gain knowledge of risk identification and evaluation of risk management practices.

Strategic supplier management according to Art. 21 (Directive (EU) 2022/2555)

Particularly important and important institutions must, as part of their risk management,Supply chain securitytake into account. This includes not only technical security, but also the establishment of a holistic governance model for relationships with direct suppliers and service providers

Unsure if you are affected by NIS2? The BSI's NIS 2 impact assessment offers you initial orientation in just a few steps.

Risk analysis and assessment (all-hazards approach)

The basis of every decision is a well-founded oneRisk analysis, which also includes non-technical factors such as undue influence by third countries on providers. This means that when selecting their suppliers, companies must not only pay attention to technical quality, but also assess whether the provider could be forced to act against the security interests of its customer or the European Union due to its origin or connections. Management must do thisCriticality of your assetsand understand the dependency on external service providers (e.g. cloud providers or managed security services).The CRA serves as a tool here:From December 11, 2027, it requires manufacturers to draw up a software bill of materials (SBOM) as part of the technical documentation. The CRA does not require handing it to customers, so NIS2 entities should agree on this by contract if they need it to assess their supply chain under Section 30 BSIG.

Supplier selection and due diligence

When selecting partners, apply clear cybersecurity criteria. These include:

• The assessment of thesafe development processesof the provider. A secure development process ensures that cybersecurity is not added as an afterthought, but rather viewed as an integral part throughout the entire life cycle of a product or service (so-calledSecurity by Design).
• Checking the financial stability and reputation of the service provider.
• The avoidance ofVendor lock-in(vendor dependency) to maintain resilience in the event of failures. AVendor lock-inarises when a company is so dependent on the products or services of a single provider that switching to another partner would only be possible at extremely high cost, time or operational risk.

Contract design and minimum requirements

Contracts must contain specific security clauses to maintain control over data sovereignty. Important components are:

• Audit rights:The right of the company or authorized third parties to inspect the supplier's security measures on site.
• Reporting requirements:The supplier's obligation to report security incidents that may affect the facilityto report immediately.
• Vulnerability handling:Clear rules for dealing with vulnerabilities and providing security updates.
• Exit strategies:Defined processes for the secure return or deletion of data at the end of the contract or upon request from the client (e.g. as a result of customer inquiries).

Transparency through SBOMs and technological control

In order to make the supply chain transparent, theSBOMinto focus. From December 2027, the CRA requires manufacturers to draw up these machine-readable lists; whether you receive them depends on your supply contracts. For IT heads and CISOs this means:

• Component tracking:Only those who know which third-party libraries are in a software can react quickly when new vulnerabilities (such as Log4j) become known.
• Patch management:Facilities must ensure that suppliers provide patches for critical vulnerabilities in a timely manner.

Special case of the financial sector:DORAas a sharper sword

Here, the management of ICT third-party risk is regulated in even more detail:

For financial entities within DORA's scope, the NIS2 risk-management and reporting obligations largely do not apply under Section 28(6) BSIG; DORA's rules apply instead.

• A comprehensive register of information on all third-party ICT service providers must be maintained.
• At theSubcontracting(Subcontracting) critical or important functions, the financial company must ensure that the entire chain of subcontractors meets the same strict standards.

Conclusion for the management level

Supplier management under NIS2 is not a one-off project;ongoing process. As management, you should ensure that:

1. A current oneRegister of all critical suppliersexists.
2. The security requirements in the contractsState of the artreflect.
3. RegularPerformance reports and auditsof the most important partners are included in your management assessment.

Supply chain security is now a key pillar of organizational resilience, protecting not only your data but also your reputation and evidence that management has fulfilled its oversight duty under Section 38 BSIG.

If you would like to find out more about the topiccontact usfor a non-binding conversation and take part in our webinar on the topic:

“When trust becomes a risk: How you can secure your supplier management with NIS2”

📅(delete block, together with ba04ccde340a and the webinar clause in 0530c0081088)

👉Register now:https://lnkd.in/d3rH4D_z

📖 Also read:NIS2 compliance consulting: scope, gap analysis and implementation