The NIS2 Directive
Attaches to every direct supplier and service provider of the entity, whatever it supplies; the depth of the assessment follows the access and the criticality.
On the register, tick "NIS2 essential or important entity" and these rows appear on every vendor the regime reaches. Framework page.
Which vendors it reaches
| Families | Cloud and hosting, Software and SaaS, Network and connectivity, Hardware and devices, Managed and professional services, Data and content, Payments and financial, Operations |
|---|---|
| On every vendor | NIS2 Art. 21(2)(d) |
| Cloud and hosting | NIS2 Art. 21(3), NIS2 Art. 24 |
| Software and SaaS | NIS2 Art. 21(3), NIS2 Art. 24 |
| Network and connectivity | NIS2 Art. 21(3), NIS2 Art. 24 |
| Hardware and devices | NIS2 Art. 21(3), NIS2 Art. 24 |
| Managed and professional services | NIS2 Art. 21(3) |
| Data and content | the clauses on every vendor only |
| Payments and financial | the clauses on every vendor only |
| Operations | the clauses on every vendor only |
| Rated critical on the register | NIS2 Art. 21(3) |
NIS2 Article 21(2)(d), the supplier relationship
The clauses the register expects in every vendor agreement the regime reaches, and the further clauses for a vendor rated critical.
- What the supplier may access, and the security obligations that bind it while it does
- Notification of incidents and of vulnerabilities in the supplier's product or service, with a timeframe
- Audit or assurance rights proportionate to the access and the criticality
- Exit and data return provisions, and the right to test them
- Sub-contractor disclosure, so the entity knows who else sits in the chain
Where the vendor rated critical on the register
- Evidence of the supplier's own secure development and vulnerability handling practice
- A route for Union coordinated supply chain risk assessment outcomes to reach the contract
The supplier clause checklist
One printable block per vendor that touches a named system or is rated critical, listing the clauses Article 21(2)(d) and 21(3) expect the supplier agreement to carry, with a tick and a where column for the contract review.
Named reference, not quoted: NIS2 Article 22, Union coordinated security risk assessments of critical supply chains (reached through Article 21(3)).
The clauses, quoted
3 of 28 in the frameworkRequirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.
NIS2 Art. 21(2)(d) Supply chain security, covering the relationship with each direct supplier and service providerThe Directive scopes this deliberately at direct suppliers and service providers, which makes the first artefact an inventory of who those parties are and which of them touch the network and information systems behind the service. From there the entity has to manage the security-related aspects of each relationship: what the supplier may access, what security obligations bind it, what happens on incident, and what happens at exit. Contract terms are the enforcement mechanism, so contracts that predate NIS2 and carry no security clauses are a live gap rather than a legacy inconvenience. Managed service providers and managed security service providers deserve separate attention because they hold privileged access into the estate, which makes their compromise the entity's incident.
Common gap: Inventory built from the procurement system, so shadow and free-tier services are missing
Source framework: NIS2 Directive
NIS2 Art. 21(3) Take account of supplier-specific vulnerabilities and of Union coordinated supply chain risk assessmentsDeciding what supply chain measures are appropriate is not left to general judgement. The entity has to take into account the vulnerabilities specific to each direct supplier and service provider, and the overall quality of those parties' products and cybersecurity practices including their secure development procedures. Separately, it must take into account the results of the Union level coordinated security risk assessments of critical supply chains carried out under Article 22(1). That second limb creates an external input the entity has to watch for and respond to: when a coordinated assessment lands on a technology the entity uses, the outcome has to reach the supplier risk decisions rather than stop at a policy team. Evidence of consideration is what is being asked for, including reasoned decisions not to change anything.
Common gap: Supplier assessment reduced to a questionnaire score with no view of that supplier's actual weaknesses
Source framework: NIS2 Directive
NIS2 Art. 24 Use certified ICT products, services and processes where the Member State requires itA Member State may require essential and important entities to use particular ICT products, ICT services and ICT processes that are certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, as a way of demonstrating compliance with particular Article 21 requirements. That requirement can arrive either through national transposition or through a Commission delegated act specifying which categories of entity must use certified products or hold a certificate. Member States must also encourage the use of qualified trust services. What binds the entity is therefore conditional and moving: it has to know whether any such requirement applies to it in each Member State whose jurisdiction it falls under, and to hold the conformity evidence where one does. Delegated acts carry an implementation period, so the practical duty is to watch for them rather than to react once the period has run.
Common gap: Assuming no requirement applies without checking each national transposition
Source framework: NIS2 Directive
See what it attaches to your list
Paste the vendor list, tick the regime, and every vendor it reaches carries these rows. Eight vendors free, no account.
Build my vendor register