NIS2: Supply Chain Security
Supply Chain Security [Art 21(2)(d), 22]
Rule: Entities must address security risks arising from relationships with suppliers and service providers, including specific security requirements in contracts.
Core Requirement [Art 21(2)(d)]
Cybersecurity risk management measures must address:
security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure
And specifically:
supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers
What Supply Chain Means
| Relationship | Example |
|---|---|
| Direct suppliers | Hardware vendors, software vendors |
| Service providers | Cloud providers, managed services, SaaS |
| Development partners | Outsourced development, contractors |
| Maintenance providers | IT support, system integrators |
Risk Assessment for Suppliers [Art 21(2)(d)]
Must assess:
- Supplier’s security practices — Do they have adequate controls?
- Dependency criticality — How critical is this supplier to operations?
- Data access — What data can the supplier access?
- System access — What network/system access do they have?
- Geographic risk — Jurisdiction and geopolitical considerations
Contractual Requirements
Contracts with suppliers should address:
| Element | Purpose |
|---|---|
| Security requirements | Minimum security measures supplier must implement |
| Incident notification | Supplier must notify you of security incidents |
| Audit rights | Right to audit or request certifications |
| Subcontractor controls | Supplier’s obligations for their suppliers |
| Termination provisions | Data return/deletion on contract end |
| Compliance certification | Regular attestation of compliance |
Due Diligence Process
Before engagement:
- Security questionnaire — Assess supplier security posture
- Certification review — Check ISO 27001, SOC 2, etc.
- Risk classification — Categorize by access and criticality
- Reference checks — Security track record
During relationship:
- Ongoing monitoring — Review supplier security status
- Incident tracking — Monitor for supplier breaches
- Contract compliance — Verify contractual obligations met
- Annual review — Reassess risk and controls
Coordinated Security Risk Assessments [Art 22]
EU and Member States may conduct coordinated risk assessments of critical supply chains (e.g., 5G security assessment model):
- Coordinated at EU level by NIS Cooperation Group
- Results may inform procurement requirements
- May result in specific product/vendor restrictions
ICT Products and Services
Special attention for ICT supply chain:
- Hardware — Risks of backdoors, tampering
- Software — Vulnerabilities, malicious code
- Cloud services — Data sovereignty, availability
- Managed services — Access privileges, incident handling
Practical Checklist
For critical suppliers:
| Check | Frequency |
|---|---|
| Security certification current? | Annual |
| Incident history review | Quarterly |
| Access permissions appropriate? | Quarterly |
| Contract terms enforced? | Annual |
| Subcontractor list updated? | Annual |
| Exit plan current? | Annual |
High-Risk Supplier Indicators
| Indicator | Risk |
|---|---|
| No security certifications | Weak security program |
| History of breaches | Pattern of incidents |
| Refuses audit rights | Transparency concerns |
| High staff turnover | Insider risk |
| Single point of failure | Concentration risk |
| Opaque subcontracting | Unknown exposure |
Supplier Categorization
| Category | Criteria | Controls |
|---|---|---|
| Critical | Essential to operations, access to sensitive data | Full due diligence, annual audits, strong contractual controls |
| Important | Significant but not essential, limited access | Standard due diligence, certification review, contractual controls |
| Standard | Limited impact if compromised | Basic due diligence, standard terms |
Integration with Art 21 Measures
Supply chain security links to other requirements:
- Risk analysis (a) — Include supplier risks in assessment
- Incident handling (b) — Include supplier incident procedures
- Business continuity (c) — Plan for supplier failure
- Secure development (e) — Secure supplier code, dependencies