NIS2 Supply Chain Security

NIS 2 Article 21(2)(d) requires essential and important entities to ensure supply chain security. They must: establish a supply chain security concept, consider security aspects of relationships with direct providers and service providers, categorize and assess suppliers by criticality, integrate security requirements into procurement processes, and continuously monitor suppliers.

NIS2-obligated entities must include cybersecurity requirements in supplier contracts: minimum security standards (e.g., ISO 27001 compliance), incident notification obligations for supplier-side events, audit and inspection rights, business continuity requirements for the supplier, and security-by-design principles. Suppliers should provide compliance evidence such as certifications or SOC

2 reports.

NIS2-compliant supplier assessment follows the C-SCRM (Cyber Supply Chain Risk Management) approach: (1) categorize suppliers by criticality (critical, important, standard), (2) due diligence review of cybersecurity practices, (3) questionnaire-based assessments and certification checks, (4) continuous monitoring (security events, CVEs, certification status), (5) escalation paths for identified issues. The BSI explicitly recommends this five-step approach.

NIS 2 promotes transparency in software supply chains. A Software Bill of Materials (SBOM) enables complete visibility into all software components, open-source libraries and dependencies. This accelerates identification of known vulnerabilities (CVEs) and speeds response to supply chain attacks. Regulators and customers increasingly require SBOMs, the EU Cyber Resilience Act (CRA) will make SBOMs mandatory for manufacturers.

DORA for financial entities has stricter third-party requirements than NIS2: it mandates a formal TPRM (Third Party Risk Management) program, concentration risk analysis, contractual minimum content (DORA Art. 30), and a register of critical ICT service providers. NIS 2 is sector-neutral and less detailed. Financial companies should establish DORA TPRM as the baseline, it simultaneously fulfills NIS 2 supply chain obligations.

NIS 2 obligations do not automatically transfer to suppliers that are not themselves essential or important entities. However, NIS2-obligated organizations must ensure that critical suppliers meet adequate security standards. Security requirements are passed on through contract clauses, in practice this creates compliance pressure throughout the supply chain. Smaller suppliers should prepare for security questionnaires from major customers.