NIS2 Supply Chain Security: Requirements and Implementation Guide

The SolarWinds attack in 2020 reached customers through a single tampered software update: SolarWinds told the SEC that fewer than 18,000 customers may have installed the compromised Orion version [6]. NotPetya in 2017 caused “billions of dollars in damage across Europe, Asia, and the Americas”, according to the White House [7], after attackers backdoored the development environment of the Ukrainian tax accounting software M.E.Doc [8]. Neither attack targeted the victims directly. Both exploited the supply chain.

These weren’t anomalies. The Verizon 2025 Data Breach Investigations Report found third-party involvement in 30% of the breaches it analysed, up from roughly 15% the year before [4].

The EU legislators took notice. The original NIS Directive (NIS1, Directive (EU) 2016/1148) did not name supply chain security in its text. NIS2 — Directive (EU) 2022/2555 — makes it one of ten minimum risk management measures in Article 21(2)(d), and the Commission Implementing Regulation (CIR) 2024/2690 adds detailed requirements for policies, supplier contracts, monitoring and a supplier directory for a defined group of digital entities.

You’re no longer responsible only for your own cybersecurity — you’re accountable for understanding and managing the risks your suppliers bring into your environment.

This guide breaks down exactly what the regulation requires, how to classify your suppliers by risk, which contract clauses you need, and how to build a monitoring process that satisfies both the CIR and your national supervisory authority.

What Article 21(2)(d) and the CIR Require

Article 21(2)(d) of the NIS2 Directive requires every essential and important entity to implement “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.”

NIS1 did not mention supply chain security at all. NIS2 dedicates a full requirement to it — and the Commission Implementing Regulation (CIR) 2024/2690 spells out the specifics in Annex section 5. Note the CIR’s scope: under its Article 1 it applies only to DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. For all other entities, the detail comes from national transposition law, and the CIR is a useful reference rather than a binding text.

What the Directive Requires

Article 21(3) expands on what “supply chain security” means in practice. Entities must:

• Evaluate vulnerabilities specific to each direct supplier and service provider
• Assess the overall quality of their suppliers’ cybersecurity products and practices, including secure development procedures
• Take into account the results of coordinated security risk assessments of critical supply chains carried out under Article 22

This applies to all entities in scope of NIS2 — both essential and important. Article 21(2)(d) is framed around the entity’s direct suppliers and service providers.

What the CIR Adds

CIR 2024/2690 Annex section 5 breaks supply chain security into two areas:

5.1 — Supply Chain Security Policy. Entities must establish, implement, and apply a policy governing relationships with direct suppliers and service providers. The policy must identify the entity’s own role in the supply chain and communicate it to those suppliers, lay down criteria for selecting and contracting suppliers (point 5.1.2), and be reviewed at planned intervals and when significant changes or significant incidents occur (point 5.1.6). Point 5.1.4 lists what supplier contracts must specify, where appropriate (detailed in the contract clauses section below).

5.2 — Directory of Suppliers and Service Providers. Entities must maintain an up-to-date registry of their direct suppliers and service providers, with a contact point for each and a list of the ICT products, services and processes each one provides. The ENISA Technical Implementation Guidance (published 26 June 2025) provides additional detail on how to implement these measures in practice.

What this means practically (CIR text checked on EUR-Lex on 29 October 2026): if the CIR applies to you, you need a supply chain security policy, a process to review suppliers, contracts that cover the topics listed in Annex point 5.1.4 where appropriate, and a supplier directory. Where the CIR states a requirement applies ‘where appropriate’ and you decide it does not, Article 2(2) requires you to document your reasoning. For a complete map of all ten NIS2 risk management measures, see our NIS2 requirements overview.

How to Classify Suppliers by Criticality

Not every supplier carries the same risk. Your cloud infrastructure provider and the company supplying office stationery don’t need the same level of cybersecurity scrutiny. Article 21(1) of the Directive requires “appropriate and proportionate” measures, and classification is a practical way to apply that proportionality.

A three-tier model works for most organisations:

Tier	Description	Examples	Assessment Frequency
Critical (Tier 1)	Direct access to your network, systems, or sensitive data. Disruption would halt essential services.	Cloud/hosting providers, managed security services, ERP/core software vendors, identity providers	Annual audit + continuous monitoring
Important (Tier 2)	Limited system access or handles non-critical data. Disruption would degrade but not halt operations.	Email platforms, HR software, specialised SaaS tools, payment processors	Annual questionnaire + periodic review
Standard (Tier 3)	No system access or data handling. Minimal operational impact if disrupted.	Office supplies, facilities management, marketing agencies (no system access)	Simplified check at onboarding + renewal review

Four Classification Criteria

Use these factors to assign each supplier to a tier:

1. System access level — Does the supplier connect to your network, access production systems, or hold administrative credentials?
2. Data sensitivity — Does the supplier process, store, or transport personal data, trade secrets, or data classified under NIS2?
3. Substitutability — How quickly could you switch to an alternative? High lock-in pushes the supplier up a tier.
4. Service criticality — Would a disruption affect your ability to deliver essential or important services under NIS2?

If a supplier scores high on any single factor, move them up a tier. Classify borderline cases upward — the cost of over-assessing is trivial compared to the cost of an unmanaged critical supplier.

Who owns classification? In organisations with a CISO, the security team leads this exercise in consultation with procurement. For SMEs without dedicated security staff, the business owner or IT manager should work through the list — the process is straightforward once the criteria are defined.

Security Requirements by Supplier Tier

Once suppliers are classified, apply tier-specific requirements. The tiers and measures below are our suggested model; the CIR does not prescribe tiers, frequencies or deadlines:

Requirement area	Critical (Tier 1)	Important (Tier 2)	Standard (Tier 3)
Security policy review	Full policy review + evidence	Policy summary + self-attestation	Accept standard terms
Risk assessment	Joint risk assessment	Supplier provides own assessment	N/A
Incident notification	Without undue delay; deadline agreed in contract	Without undue delay	Material incidents only
Audit rights	On-site or remote audit annually	Remote assessment annually	Contract clause only
Employee vetting	Background checks confirmed	Training certificates confirmed	Contractual obligation only
Secure development	SDLC evidence + pen testing	Self-attestation	N/A
Business continuity	Tested BCP/DR plan required	BCP documentation required	N/A
Termination plan	Data return + system handover	Data deletion confirmation	Standard contract terms

Gap Analysis Approach

For each Critical and Important supplier:

1. Map the supplier’s current state against the requirements above
2. Identify gaps — requirements not yet met
3. Classify each gap by effort: Low (contract clause update), Medium (supplier needs to implement controls), High (requires infrastructure changes or supplier substitution)
4. Set remediation deadlines aligned with your NIS2 compliance timeline

This gap analysis doubles as audit documentation. Keep the completed matrix as evidence of your supply chain risk management process — national supervisory authorities may ask for it.

Eight Contract Topics Listed in CIR Annex Point 5.1.4

CIR 2024/2690 Annex point 5.1.4 lists eight topics, (a) to (h), that contracts with suppliers and service providers must specify, where appropriate through service level agreements and where appropriate to the relationship. Here’s what each clause should cover:

1. Cybersecurity requirements. Specify the security standards the supplier must meet. For Critical suppliers, reference ISO 27001 or SOC 2 as a baseline. For Important suppliers, a documented information security policy may suffice. Include requirements for encryption, access control, and vulnerability management appropriate to the service provided. Point 5.1.4(a) also links this clause to the security requirements for acquiring ICT services and products in point 6.1.

2. Employee skills, training, and certifications. Annex point 5.1.4(b) covers “requirements regarding awareness, skills and training, and where appropriate certifications” for supplier staff. It is the contract end of a chain that starts at point 8.1.1, which names direct suppliers in the awareness duty itself. For Critical suppliers, consider requiring evidence of specific certifications (CISSP, CISM, or equivalent) for key personnel. The CIR sets no fixed training interval, so state one in the contract. Our guide to bringing supplier staff into your NIS2 awareness programme sets out that chain, a sample clause and the evidence to keep.

3. Background checks. For suppliers whose employees access your sensitive systems or data, require appropriate background verification. What counts as “appropriate” depends on your sector — criminal record checks, reference verification, or security clearance for entities in critical infrastructure sectors.

4. Incident notification. Point 5.1.4(d) requires suppliers to notify you “without undue delay” of incidents that present a risk to the security of your network and information systems. The CIR sets no fixed deadline, so agree one in the contract. Specify the communication channel, required information (scope, impact, remediation steps), and escalation procedures. This aligns with NIS2’s broader incident reporting obligations.

5. Audit and review rights. Point 5.1.4(e) refers to the right to audit or the right to receive audit reports. For Critical suppliers, this means on-site or remote audit rights exercisable at least annually. For others, the right to request evidence of compliance — certifications, test reports, policy documents. Define the notice period and cooperation obligations.

6. Vulnerability handling. Point 5.1.4(f) covers an obligation on suppliers to handle vulnerabilities that present a risk to the security of your network and information systems. State how the supplier will tell you about such vulnerabilities and how quickly it will fix them.

7. Subcontracting. Point 5.1.4(g) covers requirements regarding subcontracting and, where you allow it, cybersecurity requirements for subcontractors in line with the requirements in clause 1. Decide whether subcontracting needs your approval and require the supplier to pass your security terms down.

8. Termination obligations. Point 5.1.4(h) covers the supplier’s obligations when the contract ends, such as retrieval and disposal of the information it obtained while performing its tasks. In practice, also require it to revoke all access to your systems. This prevents data leakage during vendor transitions and is a requirement many organisations overlook until it’s too late.

For ready-to-use versions of these clauses, see our NIS2 templates page — Documents 42 (Supplier Security Policy), 43 (Supplier Security Assessment Questionnaire), and 45 (Supplier Security Clauses for Contracts) cover these requirements in full.

Monitoring and Ongoing Obligations

Supplier assessment is not a one-time exercise. CIR point 5.1.6 requires the policy to be reviewed, and suppliers’ cybersecurity practices monitored, at planned intervals and when specific events occur:

• Planned intervals — the CIR leaves the frequency to you; an annual review for all classified suppliers, with quarterly or continuous monitoring for Critical tier, is a workable baseline
• Significant changes — new services, system architecture changes, mergers and acquisitions, or changes in the supplier’s ownership or management
• Security incidents — any incident affecting the supplier or their sub-suppliers that could impact your systems
• EU coordinated risk assessments — if the Cooperation Group issues a coordinated risk assessment under Article 22 affecting products or services you use, Article 21(3) requires you to take the results into account [1]

When one of those security incidents actually happens — a supplier calls to say they have been breached — the response splits into three separate obligations on three different clocks. Our step-by-step guide to a NIS2 supply chain attack covers assessing your own impact, when the 24-hour Article 23 clock starts, and the documented supplier re-assessment that is due even when no report is.

Documentation Checklist

Maintain an auditable record for each classified supplier:

• Tier classification with documented rationale
• Completed assessment questionnaires or audit reports
• Signed contract covering the point 5.1.4 topics that apply, with documented reasons for any you left out
• Supplier directory entry: contact point and the ICT products, services and processes supplied (CIR point 5.2)
• Incident notification log
• Review schedule and outcomes
• Gap remediation tracking with deadlines

This documentation serves two purposes: it supports the policy, monitoring and directory requirements in CIR Annex section 5, and it provides the evidence your national supervisory authority may request during inspections. If you don’t have a record, you can’t prove compliance. For a full compliance tracking framework, see our NIS2 compliance checklist.

Frequently Asked Questions

Do I need to assess every supplier?

No. Article 21(1) of the Directive calls for proportionate measures, and the CIR asks entities to take account of their risk exposure and size (Article 2(2)). Classify suppliers into tiers based on system access, data sensitivity, substitutability, and service criticality. Standard (Tier 3) suppliers — those with no system access or data handling — need only basic contractual clauses and simplified onboarding checks. Focus your assessment effort on Critical and Important tier suppliers.

What if a supplier refuses our security requirements?

This is a risk decision, not just a compliance one. If a Critical or Important supplier won’t agree to the clauses listed in CIR Annex point 5.1.4, you have three options: negotiate alternative controls that achieve the same security outcome, accept the residual risk and document your justification in the risk register, or find a replacement supplier. For Critical tier suppliers, refusal on core requirements like incident notification or audit rights is generally a deal-breaker.

Does NIS2 require my suppliers to be ISO 27001 certified?

No. Neither NIS2 nor the CIR requires suppliers to hold ISO 27001 certification. However, ISO 27001 certification simplifies your assessment process — it provides third-party evidence of a structured information security management system. It’s a useful baseline for Critical tier suppliers, but it doesn’t guarantee NIS2 compliance on its own. You still need to verify the supplier meets the specific requirements relevant to your relationship. For a detailed comparison, see our guide on NIS2 vs ISO 27001.

How far down the supply chain must I look?

Article 21(2)(d) refers to “direct suppliers or service providers.” You’re not expected to audit your supplier’s suppliers directly. However, CIR point 5.1.4(g) asks that contracts cover subcontracting and, where you allow it, cybersecurity requirements for subcontractors. In practice, this means requiring your Critical suppliers to demonstrate they have their own supply chain security processes — creating a cascade of accountability down the chain.

What about open source software dependencies?

Open source components are part of your supply chain. Sonatype’s 2024 State of the Software Supply Chain report logged 512,847 malicious packages in the preceding year, a 156% year-over-year increase [9]. The CIR’s requirements on acquisition, development and maintenance (Annex section 6) apply here. Maintain a Software Bill of Materials (SBOM) for your critical applications, monitor for known vulnerabilities in dependencies, and include open source risk in your supply chain security policy.

Sector guides: how Article 21(2)(d) applies in practice for water utilities, the food industry, chemicals, online marketplaces and cloud providers.

Related guides

• Your RMM Tool Is NIS2’s Highest-Risk Supply Chain Vendor — and Article 21(2)(d) Requires a Written Assessment
• NIS2 Supply Chain Policy Template: It’s Not One Document, It’s Four
• NIS2 Supply Chain Cost: €3K to €120K Depending on Supplier Count (2026 Breakdown)
• How to Vet NIS2 Suppliers Without an Audit Team: A Tiered Due-Diligence Method for Article 21(2)(d)
• NIS2 Vendor Risk Scoring: The Four Criteria the Regulation Names — and the Threshold It Leaves to You

Sources

1. Directive (EU) 2022/2555 (NIS2 Directive), European Parliament and Council, 14 December 2022. EUR-Lex.
2. Commission Implementing Regulation (EU) 2024/2690, European Commission, 17 October 2024. EUR-Lex (checked 29 October 2026).
3. ENISA, NIS2 Technical Implementation Guidance, 26 June 2025.
4. Verizon, 2025 Data Breach Investigations Report, section on third-party involvement.
5. ENISA, Threat Landscape for Supply Chain Attacks.
6. SolarWinds Corporation, Form 8-K filed with the US SEC, 14 December 2020.
7. The White House, Statement from the Press Secretary on NotPetya.
8. CISA, Petya Ransomware alert, 1 July 2017.
9. Sonatype, 2024 State of the Software Supply Chain.
10. Directive (EU) 2016/1148 (NIS1 Directive). EUR-Lex.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.