The NIS2 Directive requires medium and large enterprises to assess, document, and monitor their supply chain security. Here's exactly what to do — with templates, checklists, and a free scanner you can run today.
⚡ Not sure if NIS2 applies to you? Run the free EUComply scanner on your site to check your security baseline — security headers, HTTPS, and cookie compliance are the technical foundation of NIS2 Art. 21.
The NIS2 Directive (EU 2022/2555) entered into force in 2024 and is now being transposed into national law across all EU member states. It replaces the original NIS Directive and significantly expands both scope and enforcement.
Key changes from NIS1:
The supply chain dimension is what catches most organisations off guard. It's no longer enough to secure your own infrastructure — you must assess and manage the security of every vendor that touches your systems or data.
NIS2 divides entities into two tiers:
| Tier | Size | Sectors | Penalties |
|---|---|---|---|
| Essential | 250+ employees or €50M+ turnover | Energy, transport, banking, health, digital infrastructure, public administration | Up to €10M or 2% of global turnover |
| Important | 50-249 employees or €10M+ turnover | Digital providers, postal, waste management, manufacturing, chemicals, food | Up to €7M or 1.4% of global turnover |
If your company operates in any of these sectors and meets the size thresholds, NIS2 applies to you. Many smaller vendors to NIS2 entities are also affected indirectly, because their customers will require NIS2-aligned contracts and security measures.
Article 21(2) lists 10 minimum measures for cybersecurity risk management. The supply-chain-specific ones are:
"Policies and procedures regarding the use of cryptography and, where appropriate, encryption" combined with "supply chain security including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers."
This means you must:
Vendor due diligence, supplier risk assessments, and contractual security obligations are now mandatory — not optional best practice.
📄 Need a ready-to-use NIS2 vendor clause? The ComplianceDocs store has NIS2 vendor security clauses, DPA templates, and supplier assessment checklists — instant download, developed from regulatory text.
Create a register of every third party that processes data, has network access, or provides ICT services. Include:
Label each vendor by criticality:
For critical and high-risk vendors, assess:
Every critical and high-risk vendor needs an updated agreement with:
Supply chain compliance is not a one-off assessment. You need:
Your documentation should include:
NIS2 supply chain compliance is operational, not just contractual. Paper compliance without actual security measures will not withstand an audit or incident. Use the EUComply scanner to verify technical basics across your vendors' public-facing endpoints.
Your vendor's vendors are part of your supply chain. If your CRM provider uses a sub-processor for hosting, that sub-processor's security posture affects you. Demand sub-processor lists from every critical vendor.
Don't rely on vendor self-assessments alone. Run technical scans on vendor endpoints to verify security headers, HTTPS configuration, and cookie compliance independently.
⚠️ Liability alert: NIS2 introduces personal liability for management. Company directors and CTOs can be held individually responsible for failures in cybersecurity risk management — including supply chain oversight. Document your reviews.
NIS2 doesn't exist in isolation. Your compliance program should address multiple frameworks together:
| Regulation | Overlap with NIS2 supply chain |
|---|---|
| GDPR | DPA requirements (Art. 28) overlap with NIS2 vendor contracts. One combined vendor assessment can satisfy both. |
| DORA | ICT third-party risk management (DORA Art. 28-30) mirrors NIS2 supply chain but with stricter requirements for financial entities. |
| EAA | Accessibility requirements apply to vendor-provided digital tools used by the public. |
The EUComply scanner checks technical aspects of all these frameworks in a single scan — one URL, one report.
If you're starting from scratch, here is a realistic timeline:
Enter any URL — your own site or a vendor's — and get instant compliance results for all EU frameworks.
Run free scan →No sign-up. No installation. Works on any platform.
Once your technical baseline is solid, the ComplianceDocs store has NIS2 vendor clauses, DPA templates, and supplier assessment checklists ready for instant download — $29-$149 depending on scope. For full automation, the Pro subscription ($79/yr) includes PDF reports and automated compliance monitoring.
Disclaimer: This guide is for informational purposes only and does not constitute legal advice. NIS2 requirements vary by member state transposition. Consult a qualified legal professional for advice specific to your jurisdiction and business.