Under NIS2, essential and important entities must manage cybersecurity risk in their relationships with direct suppliers and service providers. A useful supplier risk assessment identifies which suppliers can affect regulated services, examines their access, dependencies, vulnerabilities, product or service quality, and cybersecurity practices, then records what treatment, contract terms, evidence, and follow-up are needed. NIS2 does not prescribe one universal questionnaire or scoring model for every organization.
That distinction is useful because supplier risk can turn into paperwork very quickly. A vendor register with a red, amber, or green cell says little unless the team can explain why a supplier matters, what could fail, which controls reduce the exposure, and what happens when the risk changes.
The EU rule is also narrower than "assess every third party in exactly the same way." Article 21 focuses specifically on supply-chain security and relationships with direct suppliers and service providers. The depth of assessment should follow the risk they create for the systems and services the organization depends on.
Free tool
See where supplier risk sits inside your wider NIS2 gaps
Use Q-Sec's NIS2 self-assessment to review your current NIS2 readiness, including governance, monitoring, incident response, and risk-management gaps that need a remediation plan.
Start the NIS2 assessmentA supplier risk assessment is a structured way to evaluate the cybersecurity risk introduced by a vendor, service provider, or other third party.
The goal is not to decide whether a supplier is secure. The goal is to understand how much risk the supplier creates for your organization.
A cloud provider hosting customer data and a company delivering office supplies are both suppliers. They do not create the same level of cybersecurity risk.
A supplier risk assessment helps answer questions such as:
The answers help organizations identify critical suppliers, prioritize reviews, and make more consistent risk decisions.
A supplier risk assessment is no longer just a procurement exercise.
Most organizations rely on cloud platforms, software vendors, managed service providers, payroll systems, outsourced support teams, and dozens of other third parties. If one of those suppliers experiences a security incident, the impact can quickly extend beyond their environment.
That is one reason supply chain security became a specific focus under NIS2.
| Then | Now |
| Limited supplier access | Suppliers often access critical systems |
| Fewer cloud dependencies | Multi-vendor cloud environments |
| Smaller supplier ecosystems | Complex third-party relationships |
| Supplier reviews mainly during procurement | Supplier risk can change after onboarding. |
For additional context, see the official text of Article 21 in the NIS2 Directive, which outlines cybersecurity risk management requirements, including supply chain security measures.
The legal baseline sits in Article 21. Supply chain security is one of the ten minimum cybersecurity risk management areas, and the Directive gives extra detail on what organizations should consider when deciding which supplier measures are appropriate.
| NIS2 provision | What it means for supplier risk |
| Article 21(2)(d) | Supply-chain security must cover security-related aspects of relationships with direct suppliers and service providers. |
| Article 21(3) | Assess supplier-specific vulnerabilities plus the quality of products and cybersecurity practices, including secure development procedures. |
| Article 22 | Take relevant EU coordinated risk assessments of critical ICT supply chains into account when applicable. |
| Article 21(4) | When the entity finds that its measures do not comply, it must take necessary, appropriate, and proportionate corrective measures without undue delay. |
The exact legal wording is available in Articles 21 and 22 of Directive (EU) 2022/2555. The practical consequence is that supplier security needs a repeatable decision process, not a one-time procurement question.
NIS2 also keeps the assessment proportionate. A cloud provider hosting a critical application, a managed service provider with privileged access, and an office-supplies vendor do not create the same cybersecurity dependency. Giving them identical due-diligence depth wastes time on the low-risk end and can hide the suppliers that deserve real attention.
Start with direct suppliers and service providers that can materially affect the security or continuity of the services your NIS2 obligations cover. Criticality should come before questionnaire length.
A supplier usually deserves deeper review when one or more of these conditions apply:
This is a prioritization model, not a hidden NIS2 list. Article 21 does not say "privileged suppliers get score 5" or "all SaaS vendors are critical." The assessment has to reflect the real dependency in your environment.
If a supplier experienced a security incident tomorrow:
The more often you answer yes, the higher the supplier should appear on your review list.
A strong assessment moves from the supplier's role to the failure modes that matter. The questions below turn the Article 21 supply-chain requirement into an operating review without pretending that every organization needs the same questionnaire.
First establish what the supplier can reach and what it can change. Privileged access, service accounts, remote support channels, API tokens, code repositories, customer data, and network connectivity all change the impact of a supplier compromise.
The assessment should also test whether that access is broader than the service requires. A supplier with standing administrator access creates a different risk from one using time-limited access that is approved, logged, and removed after the task.
Next look at what happens if the supplier disappears for a day, a week, or permanently. The useful questions are about service dependency, recovery time, data portability, replacement options, and whether the organization has enough internal knowledge to keep operating during a supplier failure.
A supplier can have excellent security controls and still represent concentrated operational risk if there is no workable substitute. That risk belongs in the assessment even when the cause of disruption is not a cyberattack.
Article 21(3) explicitly requires attention to vulnerabilities specific to each direct supplier or service provider and to the quality of their cybersecurity practices. That means the assessment needs more than a certificate checkbox.
Evidence can include vulnerability-management processes, patching and remediation practices, access-control design, security monitoring, incident history, independent assurance, testing results, security policies, or other proof that fits the service and access level. A certification can support the assessment, but it does not automatically answer every risk created by the relationship.
Where the supplier provides software, firmware, platforms, or other ICT products, secure development becomes part of the NIS2 question. Article 21(3) names secure development procedures specifically.
The practical review can cover vulnerability handling, supported versions, security updates, dependency management, release controls, security testing, and how quickly the supplier communicates material vulnerabilities. The exact depth should follow the product's role and exposure.
A supplier incident can become your incident within minutes if the supplier hosts critical systems, holds privileged access, or provides a managed security service. The assessment should therefore examine how the supplier detects incidents, who contacts whom, what information it can provide, and how quickly that happens.
NIS2 does not impose one universal supplier-to-customer notification deadline in Article 21. Your contract may need a much shorter notification window than the organization's own regulatory reporting deadline so the internal team still has time to assess significance and meet Article 23 obligations.
A direct supplier can depend on cloud platforms, hosting providers, software components, support partners, or other subcontractors that affect the service you receive. You do not need to pretend you can audit an unlimited chain, but you do need enough visibility to understand material dependencies and concentration.
The useful question is whether a subcontractor can change the security, availability, or recoverability of the service. If the answer is yes, the primary supplier should be able to explain how that dependency is managed and how material changes are communicated.
A simple example shows why supplier type alone is a weak risk signal. The same category can produce very different outcomes depending on access, dependency, and recovery options.
| Supplier example | Main exposure | Likely assessment depth | Typical treatment |
| Cloud platform hosting a customer-facing service | Service outage, data exposure, identity or configuration compromise | High | Detailed security evidence, incident coordination, continuity, exit and data-portability planning |
| Managed service provider with privileged access | Administrative compromise, unauthorized changes, delayed detection | High | Access restrictions, logging, MFA, response coordination, evidence review, clear contract responsibilities |
| Payroll SaaS with employee data but no production access | Sensitive data exposure and business-process disruption | Medium to high | Security and privacy evidence, access controls, continuity, incident notification, recovery expectations |
| Facilities maintenance company without system access | Limited cyber exposure unless connected systems or remote access are introduced | Low | Confirm access boundary and reassess if the service changes |
| Office-supplies vendor | Minimal connection to network or regulated service delivery | Low | Basic supplier record; avoid unnecessary cyber due diligence |
This table is an example, not a scoring standard. A facilities provider with remote building-management access could move from low to high risk immediately. The assessment should follow what the supplier can affect, not the label on the purchase order.
Scoring is useful when it helps teams compare suppliers consistently, but false precision can make the register look more scientific than the underlying evidence. NIS2 does not prescribe a universal 1-to-5 vendor score.
A workable model can combine a few factors that the team can actually defend:
The important part is the rationale behind the rating. A "high" supplier should have a short, readable explanation of why it is high, which controls reduce the exposure, what residual risk remains, and who accepted the treatment.
The Directive does not publish one universal supplier evidence pack. In practice, the evidence should make the assessment reproducible: another qualified person should be able to see what was reviewed, what was decided, and what happened next.
| Evidence | What it proves |
| Supplier inventory and service owner | The organization knows which direct suppliers support relevant systems or services and who owns the relationship. |
| Criticality or risk rationale | The depth of due diligence follows a documented reason rather than convenience. |
| Assessment record and supporting evidence | Security practices, vulnerabilities, access, continuity, and other material factors were actually reviewed. |
| Risk treatment decision | Gaps led to remediation, compensating controls, acceptance, supplier change, or another recorded action. |
| Contract or SLA terms | Relevant responsibilities, incident coordination, access, evidence, or service expectations are documented where needed. |
| Review history and change triggers | The organization can show that supplier risk is revisited when the service or risk changes. |
For entity categories covered by Commission Implementing Regulation (EU) 2024/2690, the evidence expectations can be more specific because the Regulation contains detailed requirements for supply-chain policy, supplier selection, contract terms, monitoring, and review. ENISA's technical guidance gives examples of evidence for those requirements.
See the ENISA NIS2 Technical Implementation Guidance for the detailed guidance that accompanies Regulation 2024/2690.
Contract terms should follow the risk found in the assessment. A low-risk supplier does not need the same security schedule as a managed service provider with privileged access, while a critical supplier needs enough contractual clarity for the customer to operate during an incident or serious service failure.
Depending on the relationship, useful contract topics can include the following:
These are practical contract topics, not a claim that Article 21 contains the same mandatory clause list for every entity. The detailed contract requirements in Regulation 2024/2690 apply to the specific entity categories covered by that Regulation. Other organizations should check their national implementation and sector rules as well as the risk created by the relationship.
Not automatically. Selling to an NIS2-regulated customer does not by itself turn every supplier into an essential or important entity.
A supplier can be directly in scope because of its own sector, size, service type, or another NIS2 classification rule. A supplier that is outside direct scope can still face security questionnaires, evidence requests, incident-notification clauses, access requirements, and remediation obligations because its regulated customers must manage supply-chain security.
For suppliers, that distinction matters commercially. The customer may be asking for proof because Article 21 requires the customer to manage the relationship, even when the supplier itself has no direct NIS2 registration duty.
NIS2 does not set one universal annual reassessment date for every supplier. Review frequency should follow risk, and important changes should trigger a fresh look rather than waiting for the calendar.
Useful reassessment triggers include the following:
For the digital and ICT entity categories covered by Regulation 2024/2690, the detailed rules require regular monitoring and review of supply-chain security. Other NIS2 entities should avoid copying a frequency from another sector without checking whether it makes sense for their own risk and national rules.
The 2024 implementing regulation turns parts of Article 21 into more detailed technical and methodological requirements for specified digital, ICT service-management, and trust-service entities. Its supply-chain section is more prescriptive than the Directive's general baseline.
Among other things, those entities must establish a supply-chain security policy, define criteria for selecting and contracting suppliers, take relevant coordinated supply-chain risk assessments into account, and include specified security provisions in supplier contracts where appropriate. Selection criteria include supplier cybersecurity practices and secure development, ability to meet security specifications, product or service quality and resilience, and diversification or vendor lock-in where applicable.
The detailed legal text is in section 5 of the Annex to Commission Implementing Regulation (EU) 2024/2690. Teams outside those named categories can use the structure as a useful reference, but they should not present every provision as a binding requirement that applies to all NIS2 entities.
Do not start by emailing the same 150-question form to every vendor. Start by finding the suppliers that can actually change the organization's risk, then spend the deeper work there.
A practical implementation order is:
The result should be a living supplier-risk process. If the only output is a spreadsheet that procurement updates once a year, the organization will struggle to explain how supplier risk affects real security decisions.
Most supplier assessment problems do not start with bad intentions. They start with limited time, too many vendors, and a process that gradually becomes inconsistent.
Here are a few patterns we see regularly.
This sounds fair until you realize that a cloud provider and a company supplying office furniture are receiving the same level of attention.
The result is usually predictable: too much effort spent on low-risk suppliers and not enough on the vendors that matter most.
Certifications are useful. They are also only one piece of the picture.
A supplier can have strong security practices and still create significant risk simply because of the role they play in your business.
Many supplier assessments happen once and then disappear into a folder.
Meanwhile, services change, access expands, suppliers acquire other companies, and subcontractors enter the picture. The supplier you approved three years ago may not be the same supplier you rely on today.
Maybe you do. The question is whether the next person reviewing the assessment will know.
If the rationale only exists in someone's head or in a meeting nobody documented, the assessment becomes difficult to defend and even harder to repeat consistently.
Looking beyond the supplier. One thing that often gets missed is who the supplier depends on. A vendor may appear low risk until you discover that key parts of their service are delivered by other providers you have never assessed.
The goal is not paperwork. The best supplier assessments are usually the simplest. They help you answer one practical question:
"If this supplier had a serious security incident tomorrow, how much would it affect us?"
Supplier assessment works when it changes what the organization does. High-risk access gets restricted. Weak evidence leads to remediation. Critical dependencies get recovery options. Contract terms reflect the incident and continuity needs of the service.
That is the useful reading of Article 21: know which supplier relationships can hurt the systems and services you depend on, understand why, and keep enough evidence to show that the risk was assessed and treated rather than filed away.
Turn supplier-risk findings into a workable NIS2 remediation plan
Q-Sec supports NIS2 scoping, gap assessment, technical and organizational measures, evidence preparation, and implementation work for European organizations.
Free guide
Assess your ICT suppliers with the NIS2 Supplier Risk Assessment Kit
A questionnaire, risk matrix, and checklist for consistent supplier reviews under NIS2.
Get the free kitSupplier risk is the cybersecurity exposure created by direct suppliers or service providers that can affect an entity's systems or services. NIS2 requires supply-chain security as part of Article 21 risk management.
NIS2 requires organizations to manage supply-chain security and consider supplier-specific vulnerabilities, product quality, and cybersecurity practices. It does not prescribe one universal assessment form or numerical scoring method.
Start with direct suppliers and service providers that can affect relevant systems, data, service continuity, privileged access, software, infrastructure, detection, response, or recovery. Assessment depth should follow risk.
No. NIS2 does not state that every supplier must hold ISO 27001 certification. Certification can support due diligence, but the customer still needs to assess the risks created by the specific supplier relationship.
A small supplier is not automatically directly regulated because it serves an NIS2 entity. It can still face contractual security requirements from regulated customers, and it can be directly in scope under other NIS2 rules.
There is no universal annual deadline in the Directive for every supplier. Review should follow risk and be triggered by material service changes, incidents, vulnerabilities, contract changes, or other developments that alter exposure.
It is the process of identifying and treating cybersecurity risk arising from direct suppliers and service providers, including supplier vulnerabilities, security practices, product quality, secure development, dependencies, and related controls.
Article 21 does not give every entity one universal supplier clause list. Incident-notification terms are often appropriate for material suppliers because customers need time to assess and meet their own reporting duties. Regulation 2024/2690 adds detailed contract rules for specified entities.