NIS2 Procurement and Supply Chain Security — Supply chain security in NIS2

In this lesson

Read article 21(2)(d) word for word and identify the legal perimeter it sets: the entity's direct suppliers and service providers.
Explain why the legislator singled out the supply chain, using recitals 85, 86 and 88 of the directive.
Show why outsourcing a system or a service does not move the obligation away from the entity or its management body.
Map the instruments that shape supply chain security, from articles 21(3), 22 and 24 to Implementing Regulation (EU) 2024/2690 and national law, and say whom each one binds.

The text of point (d)

Article 21(1) requires member states to ensure that essential and important entities take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services”. Article 21(2) then lists ten measures that those measures “shall include at least”. The fourth is point (d):

“supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”

Read it in two halves. The first, supply chain security, is broad: the risks that reach the entity through what it buys and runs, from hardware and software updates to cloud services and outsourced operations. The second makes one part explicit: the relationship with direct suppliers or service providers, where contracts, access rights, data held by the supplier, incident notification and exit belong.

Three expressions carry the weight.

“direct suppliers or service providers”. The relationship the text names is first-tier. Your cloud provider's own hosting contractor, or the open-source libraries inside your software vendor's product, are not your direct suppliers. Recital 85 addresses the deeper levels in permissive terms: “Those entities could consider risks stemming from other levels of suppliers and service providers.” Could, not should. Your own risk assessment decides where you look further.
“suppliers or service providers”. Both goods and services are covered. A firewall vendor and a managed service provider that administers the firewall are both in the perimeter.
“security-related aspects”. Point (d) does not regulate price or delivery terms; access, notification, audit and continuity are its business.

Which suppliers count? Article 21(2) says the measures follow “an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents”. The practical test is therefore not whether a supplier sells ICT, but whether its failure or compromise can affect the security of your network and information systems or their physical environment. A contractor that maintains the cooling in your server room passes that test. A stationery supplier does not.

Why the supply chain is singled out

Recitals 85, 86, 88

Recital 85 gives the reason in one sentence. Addressing these risks “is particularly important given the prevalence of incidents where entities have been the victim of cyberattacks and where malicious perpetrators were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third-party products and services.” It names the suppliers it has in mind: “providers of data storage and processing services or managed security service providers and software editors”. And it points to the main lever: entities “should in particular be encouraged to incorporate cybersecurity risk-management measures into contractual arrangements with their direct suppliers and service providers.”

Two attack paths sit behind that wording, and a supply chain programme has to address both.

Through a product. A vulnerable or tampered component, library or update reaches every customer that installs it.
Through a provider with access. A provider that administers systems remotely, holds credentials or runs security tooling offers an attacker a trusted path into each of its customers.

Recital 86 develops the second path for one category. Managed security service providers in areas such as incident response, penetration testing, security audits and consultancy play a particularly important role in assisting entities, but they “have however also themselves been the target of cyberattacks and, because of their close integration in the operations of entities pose a particular risk.” Hence the conclusion: entities “should therefore exercise increased diligence in selecting a managed security service provider.”

Recital 88 widens the view beyond classic vendors. Entities should address risks from their relationships “within a broader ecosystem, including with regard to countering industrial espionage and protecting trade secrets”, including cooperation with academic and research institutions. And “when relying on data transformation and data analytics services from third parties, those entities should take all appropriate cybersecurity risk-management measures.”

Outsourcing does not outsource the obligation

Recital 83, art. 20(1)

Recital 83 settles a question that procurement teams can get wrong: the risk-management measures and reporting obligations “should apply to the relevant essential and important entities regardless of whether those entities maintain their network and information systems internally or outsource the maintenance thereof.”

Three consequences follow.

The measures still apply to the outsourced system. When payroll moves to a software-as-a-service provider, access control, logging, backup and continuity for payroll remain the entity's measures; the contract and the supplier's evidence are how it exercises them.
The management body stays accountable. Article 20(1) requires member states to ensure that management bodies approve the measures taken to comply with article 21, oversee their implementation, and can be held liable for infringements of that article by the entity. A supply chain security policy is one of those measures; it needs the same approval as the rest.
The incident is still yours to assess. An outage or breach at a supplier that affects your services is an event you must assess against article 23 on your own clock. Module 3 deals with this in detail.

The instruments, and whom they bind

Reg. 2024/2690, art. 1

Several texts shape point (d). They do not all bind the same people.

Article 21(2)(d) and 21(3) are addressed to member states, which must ensure that entities apply them. Your legal obligation is the national provision that transposes them, which may be worded or numbered differently. Check your country on the transposition tracker.
Article 21(2)(e) covers “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure”. A useful division of labour: point (d) governs the relationship with the supplier, point (e) the security of what you acquire.
Article 22 provides for Union-level coordinated security risk assessments of critical supply chains. Article 21(3) makes their results a mandatory consideration (lesson 4.1).
Article 24 lets member states require the use of ICT products, services and processes certified under European cybersecurity certification schemes, and empowers the Commission to adopt delegated acts to the same end (lesson 4.2).
Implementing Regulation (EU) 2024/2690 sets out, in section 5 of its annex, detailed requirements for supply chain security and, in point 6.1, for security in the acquisition of ICT services and products. It binds only the entity types listed in its article 1: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. For every other entity it is a detailed reference, not an obligation, unless national law makes it one.
Article 7(2)(a) and (b) oblige member states, not entities, to adopt policies addressing cybersecurity in the supply chain for ICT products and services, and on cybersecurity requirements in public procurement. Public buyers will meet these in national procurement rules.
Article 29(2) provides for information-sharing communities of entities “and where relevant, their suppliers or service providers”. Participation is voluntary.

Proportionate, not uniform

Art. 21(1), 21(4)

Article 21(1) requires measures that ensure a level of security appropriate to the risks posed, and states how proportionality is judged: “due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.” Applied to suppliers, this means that the depth of treatment follows the risk each supplier carries. Sending the same long questionnaire to every supplier buries the few that matter under paperwork about the many that do not. Module 2 shows how to tier.

Article 21(4) adds a duty that applies the moment you find a gap: an entity that finds it does not comply with the measures takes, “without undue delay, all necessary, appropriate and proportionate corrective measures.” A critical supplier that was never assessed is such a gap. The answer is a dated remediation plan, not silence until the next audit.

In practice

A fictitious parcel and courier company, an important entity under Annex II with 900 staff, starts its supply chain programme by asking a simple question: who are our suppliers? Finance's vendor master lists 1,180 active suppliers. The IT contract register lists 140. Neither list says which suppliers can reach the company's systems.

The security team cross-checks applications connected to single sign-on, firewall rules allowing inbound connections, and directory accounts held by external staff. It finds 23 suppliers with network or application access. Six are missing from the IT register: a marketing analytics firm with an interface into the customer database, a building-management contractor with remote access to the server-room cooling controllers, and four consultants with accounts that were never closed.

The policy the management body approves a month later states the perimeter in one sentence: every direct supplier or service provider whose failure or compromise could affect the security of the company's network and information systems or their physical environment. The four dormant accounts are closed the same week, and the analytics firm's interface is restricted to the fields it actually needs.

What a supervisor will ask

Show me your supply chain security policy and the management body's approval of it. The policy, the minutes or decision record, and the date.
Which suppliers fall within your policy, and how did you decide? The perimeter rule and the directory it produced.
For the systems you outsource, who carries out each measure? A responsibility matrix per critical service, showing what the supplier does and what you verify.
Which texts apply to you? The national provision you comply with and, if you are one of the entity types in article 1 of Implementing Regulation (EU) 2024/2690, how you meet section 5 of its annex.

Key points

Article 21(2)(d) covers supply chain security, including security-related aspects of the relationship between each entity and its direct suppliers or service providers.
The legal perimeter is first-tier; recital 85 says entities could consider deeper levels, and the risk assessment decides where.
The test for including a supplier is whether its failure or compromise can affect the security of your network and information systems or their physical environment.
Outsourcing does not move the obligation (recital 83); the management body approves and oversees the measures (article 20(1)).
Implementing Regulation (EU) 2024/2690 binds only the entity types in its article 1; for others it is a reference.
Proportionality under article 21(1) means depth of treatment follows each supplier's risk.