NIS2 for suppliers: what your customers will start asking you

NIS2 is the EU's main cybersecurity law for essential and important entities, and it reaches suppliers through their customers. Even if your company is not in scope itself, a customer that is in scope must manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers." That is Article 21(2)(d) of Directive (EU) 2022/2555.

In practice this means questionnaires, new contract clauses, requests for evidence and, sometimes, a right to audit. This applies to US companies too, if they provide software, hosting, IT or other services to EU customers covered by NIS2.

This article summarizes what the directive and its implementing rules actually say about suppliers, and how to prepare answers that hold up.

The key dates and articles

• The directive was adopted on 14 December 2022. Member States had to adopt their national laws by 17 October 2024 and apply them from 18 October 2024 (Article 41).
• Article 20 requires management bodies of covered entities to approve the cybersecurity risk-management measures and oversee their implementation.
• Article 21(2) lists at least 10 areas of measures, from risk analysis and incident handling to supply chain security, vulnerability handling and multi-factor authentication.
• Article 21(3) says that when choosing supply chain measures, entities must take into account "the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers."
• Article 23(4) sets incident reporting stages for the covered entity: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after the notification.

NIS2 is a directive, so the binding obligations come from each country's national law. Details differ; your customer's legal team will tell you which law applies to them.

What the implementing regulation adds

For certain digital providers (including cloud computing, data centre, managed service and managed security service providers), the Commission set out detailed requirements in Implementing Regulation (EU) 2024/2690. Its annex, point 5.1, is the clearest description of what customers will ask suppliers. Covered entities must set criteria to select suppliers, including their cybersecurity practices and secure development procedures, and their contracts should specify, where appropriate:

• cybersecurity requirements for the supplier,
• training and, where appropriate, certifications of the supplier's staff,
• background checks of staff,
• an obligation to notify the customer of incidents without undue delay,
• the right to audit or to receive audit reports,
• an obligation to handle vulnerabilities that present a risk to the customer,
• rules for subcontracting,
• obligations at the end of the contract, such as returning and disposing of data.

Even customers outside that regulation's scope often use it as a template, because it turns Article 21 into a concrete list.

What your customers will actually send you

Expect some mix of these:

1. A security questionnaire covering access control, multi-factor authentication, backups, encryption, vulnerability handling and incident response.
2. Contract addenda with incident notification deadlines short enough for the customer to meet its own 24 hour early warning.
3. Requests for evidence: policies, audit reports, certificates such as ISO/IEC 27001 or a SOC 2 report, and test results.
4. Questions about your subcontractors, especially hosting and support.
5. Ongoing monitoring: point 5.1.6 of the annex asks entities to monitor changes in suppliers' cybersecurity practices at planned intervals, so expect repeat questions.

Prepare answers that can be checked

Questionnaires are easy to fill in optimistically. Increasingly, customers check the parts that are visible from outside. Before you answer, make sure the outside of your company matches what you write:

• Email authentication. If you claim strong email security, your DMARC record should be at enforcement:

dig +short TXT _dmarc.yourcompany.com
"v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.com"

• TLS and certificates. Valid certificates on every public hostname, none expired, none on forgotten hosts.
• Exposed services. No remote desktop, database or admin panels open to the internet.
• Website hygiene. Security headers present, no exposed .env, .git or backup files (see exposed .env, .git and backup files).
• Forgotten assets. No abandoned staging or test servers under your domain (see forgotten staging and test servers).

A clean outside view does not prove a mature program, but a weak one contradicts a good questionnaire very quickly.

A preparation checklist

• Name an owner for customer security questionnaires and keep a reusable answer set.
• Write an incident notification procedure with a contact and a deadline you can actually meet.
• Keep a current list of your own subcontractors and what data they handle.
• Document how you handle vulnerabilities, from report to fix.
• Collect evidence in one place: policies, audit reports, certificates, test summaries.
• Review your external surface regularly and fix what a customer would see.
• Re-check before each contract renewal.

Where Guarding fits

Datahorses Guarding watches your company from the outside every day: domains, DNS, certificates, email authentication, websites and exposed services. Findings come with exact fix steps and are kept as a record you can refer to when a customer asks how you watch your own exposure. We do not enter your systems and need no access; see what we guard or how cooperation works.