CIR 8.1.1 Names Your Direct Suppliers: How to Bring Their Staff Into Your NIS2 Awareness Programme via the Contract

Short answer: yes, and the regulation says so in its own words. Annex point 8.1.1 of Commission Implementing Regulation 2024/2690 requires relevant entities to ensure that their “employees, including members of management bodies, as well as direct suppliers and service providers are aware of risks, are informed of the importance of cybersecurity and apply cyber hygiene practices”. That sentence carries no “where appropriate”. The qualifier arrives one point later, in 8.1.2. There, the awareness programme is offered to direct suppliers “where appropriate in accordance with point 5.1.4” — and 5.1.4 is the point on supplier contracts.

So for a supplier’s staff, awareness is a contract decision first and a training event second. This guide follows that chain through four Annex points and shows where ENISA’s own guidance drops the supplier wording. It then covers how to decide which suppliers get what, gives a clause you can adapt, and lists the evidence an auditor can ask for.

One disclosure: we sell NIS2 templates, including a supply chain pack. Weigh our product mention with that in mind. Everything else here is sourced to the Official Journal text or to ENISA.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Does this apply to you? Scope first

In plain terms: every NIS2 entity has to secure its supply chain and train people. Only eleven types of digital-sector entity are bound by the detailed Annex wording quoted in this article. For everyone else, national law is the legal test and the Annex is a strong reference point.

The Directive sets the two duties that meet here. Article 21(2) of the NIS2 Directive lists “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” (point d) and “basic cyber hygiene practices and cybersecurity training” (point g). The detail sits in the Implementing Regulation 2024/2690 (CIR), whose Article 1 limits it to the entity types named in Article 21(5).

Your organisation	Supplier-awareness duty	What is the legal test?
DNS service provider, TLD registry, cloud, data centre, CDN, managed service provider, managed security service provider, online marketplace, search engine, social networking platform, trust service provider	Annex points 8.1.1, 8.1.2, 5.1.4(b) and 10.1.2(a) apply directly	The CIR Annex text itself, plus national enforcement
Any other essential or important entity (energy, health, manufacturing, transport and so on)	Article 21(2)(d) and (g) as transposed nationally	Your national law. Article 21(5) says the Commission “may” adopt rules for these sectors; until then the Annex is a reference, not the test
A supplier to an NIS2 entity, not in scope yourself	No direct duty	The training clauses your customers write into your contract (see our supplier’s guide to NIS2 contract requirements)

If you sit in the second row, the chain below is still the most detailed public description of what “supply chain security” plus “training” means once the two meet. Expect auditors and large customers to use it.

Four Annex points, one chain: what the text actually says

In plain terms: the outcome (supplier staff are aware and apply hygiene) has no qualifier. Everything about how you get there is qualified and routed through the supplier contract.

Annex point	Operative words (verbatim)	Qualifier	What it produces
8.1.1	ensure that … direct suppliers and service providers are aware of risks, are informed of the importance of cybersecurity and apply cyber hygiene practices	None	The outcome you are measured against
8.1.2	offer … to direct suppliers and service providers where appropriate in accordance with point 5.1.4, an awareness raising programme	“where appropriate”, routed via 5.1.4	A per-supplier programme decision
5.1.4(b)	requirements regarding awareness, skills and training, and where appropriate certifications, required from the suppliers’ or service providers’ employees	“where appropriate” twice in the lead-in	A contract clause or SLA term
10.1.2(a)	mechanisms to ensure that all employees, direct suppliers and service providers, wherever applicable, understand and follow the standard cyber hygiene practices that the relevant entities apply pursuant to point 8.1	“wherever applicable”	A way to confirm it happened, such as an acknowledgement

Read together, the four points give you room on method but not on result. You may decide a supplier doesn’t need your programme. You still need some basis for showing that the supplier’s people who touch your systems are aware of risks and follow your hygiene rules. That basis might be their own training, a clause, a signed acknowledgement, or all three.

The cross-reference is telling. When we searched the Annex, the phrase “in accordance with point 5.1.4” appeared exactly twice: in 8.1.2 (awareness) and in 10.2.1 (background verification of suppliers’ staff). Both duties concern a supplier’s individual staff, and both are tied to your contract because you have no employment relationship with those people. The contract is the lever you hold. The two cross-references mirror 5.1.4(b) and 5.1.4(c) one-for-one.

Two drafting details matter in practice:

• “Direct” limits the scope. Points 8.1.1 and 8.1.2 name direct suppliers only. Your supplier’s subcontractors are reached through 5.1.4(g), which requires subcontracting terms and, where you allow subcontracting, security requirements that flow down. Recital 85 of the Directive says entities “could consider” risks from other levels of suppliers. A recital is guidance, not a binding rule.
• Every “not appropriate” needs a record. CIR Article 2(2) says that where an entity considers a “where appropriate” requirement not appropriate, it “shall in a comprehensible manner document its reasoning to that effect”. Excluding a supplier from the programme is allowed. Doing it silently is not.

The phrase ENISA’s guidance leaves out

In plain terms: ENISA’s main NIS2 implementation guide quotes point 8.1.1 without the supplier words. Its supplier-awareness advice sits under human resources security instead. A gap assessment built only from ENISA’s section 8 will miss suppliers.

When we compared ENISA’s Technical Implementation Guidance (version 1.0, June 2025) with the Official Journal text, the two versions of 8.1.1 differed:

Source	Point 8.1.1 as printed
Official Journal (CIR 2024/2690)	“…shall ensure that their employees, including members of management bodies, as well as direct suppliers and service providers are aware of risks…”
ENISA Technical Implementation Guidance v1.0, p. 111	“…shall ensure that their employees are aware of risks…”

ENISA reprints 8.1.2 with the supplier phrase intact. But its guidance bullets and “examples of evidence” under 8.1 are written for employees only. They cover a programme outline with “objectives, content, frequency, syllabus and schedule”, copies of materials, and sign-in sheets or completion certificates. The document doesn’t explain the shorter 8.1.1 wording, and we won’t guess why it differs.

The supplier advice appears about ten pages later, under point 10.1 (human resources security). There, ENISA suggests that entities “require suppliers and service providers to designate responsible contacts for cybersecurity and encourage or mandate participation in relevant security briefings or training programmes provided by the entity”. Under 10.1.2 it adds: “Wherever applicable, require employees of direct suppliers and service providers, to follow similar awareness raising on cyber hygiene via contractual clauses.” Its evidence examples include signed acknowledgements from direct suppliers. They also include something few checklists mention: “written justifications by the direct supplier or service provider in cases where these clauses do not exist in the contract”.

ENISA’s guidance is not law; the document itself says it represents ENISA’s views. Where it and the Official Journal differ, the Official Journal text applies. In practice: if your Annex 8 gap assessment was copied from ENISA’s section 8, add a supplier row and point it at 5.1.4 and 10.1.

Deciding “where appropriate”: which suppliers get what

In plain terms: decide supplier by supplier, based on what each one can reach. 5.1.4 says the contract terms rest on your supply chain security policy and on “the results of the risk assessment carried out in accordance with point 2.1”. The risk assessment, not the supplier’s size, drives the answer.

There are three workable delivery models:

1. Join your programme. Named supplier staff take your awareness modules as guests.
2. Supplier’s own programme, with evidence. The supplier trains its people. You require it by clause and verify it on request.
3. Hybrid. The supplier’s own programme covers general hygiene. You add a short briefing on your environment.

The hybrid model is the default we’d reach for whenever supplier staff touch your systems. The reason is 8.1.2(c). It requires the programme to cover “the cybersecurity risk-management measures in place, contact points and resources for additional information and advice”. Those are your measures and your contact points. A supplier’s generic phishing course, however good, can’t tell its engineer which number to ring at your company when something looks wrong. Only you can supply that part. It is usually a short briefing plus a one-page summary of your user hygiene rules (our map of NIS2 cyber hygiene practices lists which ones the Annex actually binds). Your 5.2 supplier register already holds contact points for each direct supplier, so the briefing list can come straight from it.

Supplier profile	Typical model	What the 5.1.4(b) clause asks for	Evidence to keep
Managed service provider with administrator access to your systems	Hybrid; named admins may join your programme	Awareness and role-specific training for named staff before access; attendance at your briefing	Attendance records, signed acknowledgements, certification copies where you require them
Cloud or SaaS provider holding your data, no staff in your environment	Supplier’s own programme	Supplier maintains an awareness programme for staff handling your data; evidence on request	Clause text, plus an audit report under 5.1.4(e) or a certificate
On-site contractor with physical or network access (maintenance, field service)	Short site briefing	Briefing on your site rules and reporting contact before first visit	Signed briefing sheet per visitor
Large vendor on non-negotiable standard terms	Supplier’s own programme, documented	Usually no bespoke clause	Published security commitments or an ISO 27001 / SOC 2 report (options ENISA lists for large suppliers), plus your Article 2(2) reasoning
Commodity supplier with no access to systems or data	None	No clause	One line of Article 2(2) reasoning in the supplier register

For a CISO, the critical rows are the first and third. Privileged and physical access are where a supplier’s untrained person becomes your incident. For an SME owner, the work is usually smaller than it looks: two or three suppliers get the hybrid model, and the rest get a documented “not applicable”. If you haven’t tiered suppliers yet, start with our supplier classification guide. ENISA’s free AR-in-a-Box toolkit includes a guideline on awareness campaigns for external stakeholders, which fits the supplier briefing.

A 5.1.4(b) training clause you can adapt

In plain terms: the clause names who must be trained, on what, by when, and how you’ll know. Keep it short. Tie anything you want enforced to a measurable obligation.

Sample wording (a general template, not legal advice; adapt it with counsel and to your national law):

Security awareness and training. (1) The Supplier shall ensure that all Supplier personnel who access the Client’s network and information systems, data or premises have completed cybersecurity awareness training covering current threats and user cyber hygiene before access is granted, and repeat it at the interval stated in Schedule [X]. (2) Before first access, such personnel shall complete the Client’s supplier security briefing, covering the Client’s security measures relevant to the Services, user hygiene rules and incident-reporting contact points, and shall confirm in writing that they have understood it. (3) Personnel in the roles listed in Schedule [X] shall hold or obtain the training or certifications stated there. (4) The Supplier shall provide training and acknowledgement records within [number] business days of request. (5) The Supplier shall impose equivalent obligations on any permitted subcontractor whose personnel receive such access.

Four drafting notes:

• Don’t write “annual” as if the law requires it. 8.1.2(a) says “scheduled over time, so that the activities are repeated and cover new employees”. 8.1.3 says “at planned intervals”. ENISA’s guidance suggests reviewing the programme at least annually. Choose your interval, put it in the schedule, and enforce that.
• “Offer” versus “require”. 8.1.2 obliges you to offer the programme. Requiring the supplier’s people to attend is a commercial term you add, and ENISA’s 10.1 guidance supports “encourage or mandate”.
• Part (2) maps to 10.1.1. That point asks that direct suppliers “understand and commit to their security responsibilities”. A written confirmation is the simplest proof of commitment.
• Part (5) is your only reach to tier 2. It sits on 5.1.4(g), not on 8.1.

This clause covers one of the eight 5.1.4 categories. For drafting language on the other seven, see our guide to NIS2 vendor contract clauses.

Rollout: steps, owners and effort

In plain terms: most of the effort sits in contract renewals. Sorting suppliers into models is the smaller part of the job.

Step	Owner	Effort
1. List direct suppliers from your 5.2 register and mark what each can access (systems, data, premises)	CISO / IT security	Low
2. Link each to your point 2.1 risk assessment results and assign a model, or “none”	CISO with compliance	Medium
3. Write the Article 2(2) reasoning for every “none” or reduced model	Compliance officer	Low
4. Build the supplier briefing: your measures, hygiene rules, contact points (8.1.2(c))	Training owner	Medium
5. Insert the clause in new and renewed contracts (ENISA’s 5.1.4 guidance: “all relevant new and renewed contracts”)	Legal / procurement	High
6. Collect records and acknowledgements; chase gaps	Supplier relationship owner	Low
7. Review at planned intervals and after significant supplier incidents (5.1.6)	CISO; management body oversees	Low

For the board: Article 20(1) of the Directive requires management bodies to approve the risk-management measures and oversee their implementation. The useful thing to show them is short: which suppliers are in the programme, which were excluded, and why. The exclusion list is where we would expect a supervisor’s questions to start.

What an auditor can ask you to show

In plain terms: one document per link in the chain. If any link is missing, the 8.1.1 outcome is an assertion rather than evidence.

1. Your awareness programme outline, with direct suppliers named as an audience (8.1.2)
2. The supplier briefing content and its contact points (8.1.2(c))
3. The supplier register showing model and access level per direct supplier (5.2)
4. Contract clauses or SLA terms covering staff awareness and training (5.1.4(b))
5. Article 2(2) reasoning for each supplier left out of the programme
6. Training records and signed acknowledgements from supplier staff (10.1.2(a); ENISA’s 10.1 evidence examples)
7. For suppliers without a clause: written justification or a third-party audit report (ENISA 10.1; 5.1.4(e))

Records for your own employees follow the same logic. Our NIS2 training requirements guide covers the staff and management-body side, and our comparison of training platforms and policy templates shows which of these items a platform export can prove. For the wider supplier programme this clause belongs to, see our supply chain security guide.

Frequently asked questions

Do we have to train our suppliers’ staff ourselves?

Not necessarily. Point 8.1.2 obliges you to offer the awareness programme to direct suppliers where appropriate under 5.1.4. A supplier can meet a 5.1.4(b) clause through its own training. The part only you can provide is the briefing on your measures and contact points, which 8.1.2(c) asks the programme to cover.

Does this apply if we’re not one of the eleven CIR entity types?

The Annex wording binds only the entity types in CIR Article 1. Other essential and important entities answer to Article 21(2)(d) and (g) as transposed into national law. The Annex is the most detailed reference available, and auditors and customers often use it.

Is annual supplier training required?

The CIR sets no fixed interval for awareness training. Point 8.1.2(a) requires repeated activities that cover new staff, and 8.1.3 requires updates “at planned intervals”. ENISA’s guidance suggests an annual review of the programme. Set your own interval in the contract schedule; our guide to how often NIS2 training must run covers where the annual figure comes from.

Does the duty reach our supplier’s subcontractors?

Not directly. Points 8.1.1 and 8.1.2 name direct suppliers. You reach subcontractors through the flow-down requirements in 5.1.4(g), which is why the sample clause includes part (5).

What if a supplier refuses the clause?

Record the refusal and your assessment of the risk, and consider alternative evidence such as an audit report under 5.1.4(e). ENISA’s 10.1 evidence examples include a written justification from the supplier where no clause exists. If the supplier has privileged access and offers no assurance at all, escalate it as a risk-acceptance decision under point 2.1.1, which gives that acceptance to management bodies or other accountable persons.

Sources

1. Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 — EUR-Lex, Official Journal text. Articles 1 and 2(2); Annex points 2.1.1, 5.1.4, 5.1.6, 5.2, 8.1.1–8.1.3, 10.1.1, 10.1.2 and 10.2.1.
2. Directive (EU) 2022/2555 (NIS2 Directive) — EUR-Lex. Articles 20(1), 21(2)(d) and (g), and 21(5); Recital 85.
3. Technical Implementation Guidance on cybersecurity risk-management measures, version 1.0 — ENISA, June 2025. Guidance under Annex points 5.1.4 (pp. 67–68), 8.1.1–8.1.3 (pp. 111–113) and 10.1.1–10.1.2 (pp. 121–122).
4. AR-in-a-Box — ENISA, awareness-raising toolkit.