Most organisations think they’re doing vendor security. They aren’t. They have spreadsheets, outdated questionnaires, and blind trust in cloud providers.
NIS2 changes everything. Under the new regime, third-party risk is no longer optional ; it’s regulated, auditable, and enforceable. If one of your suppliers fails, you are accountable.
Here’s how to get supply chain security right under NIS2.
NIS2 does not care how big your supplier is, what logo they have, or whether they’re “ISO certified.” Regulators care about whether:
- you identified your critical dependencies
- you assessed them
- you monitor them
- you contractually control them
- you can exit if they fail
- you can continue operating without them
This is not vendor management ; it’s operational resilience across your digital ecosystem.
Let’s break down what you must do.
1. Start With Dependency Mapping (The Real Blind Spot)
You cannot assess what you cannot see. Your first responsibility under NIS2 is to map your third-party dependencies.
You need to map:
- your direct SaaS providers
- your MSPs / IT providers
- your cloud platforms
- your payment providers
- your OT & IoT providers (if relevant)
- your hosting environments
- your subcontractors
- the subprocessors used by your suppliers
Do not stop at Tier 1. A SaaS vendor that relies on another SaaS vendor is still your dependency.
Anecdote: A company passed a NIS2 pilot audit purely because they could show a complete dependency map ; even before having full security controls.
Visibility is your first deliverable.
2. Classify Your Suppliers (Critical, Important, Non-Critical)
NIS2 requires risk-based prioritisation.
Use a simple, defensible three-tier model:
Critical
If this supplier fails, operations stop. Examples: cloud hosting, core SaaS, identity providers, MSPs.
Important
Disruption impacts efficiency, safety, or legal obligations. Examples: HR platforms, CRM, payroll, payments.
Non-Critical
Failure is manageable. Examples: marketing tools, non-sensitive analytics.
Tip: You classify based on your business impact ; not the supplier’s size or reputation.
3. Perform Structured Risk Assessments (Mandatory under NIS2)
For critical and important suppliers, you must produce a documented, auditable risk assessment.
Assess:
- security posture (controls)
- resilience posture (BC/DR)
- incident history
- data sensitivity
- regulatory exposure
- subcontractor chains
- cloud region risks
- concentration risk
- exit feasibility
Deliverables:
A clear, dated assessment linked to evidence.
Tools that help:
- Eramba (best value)
- CISO Assistant (lightweight)
- OneTrust (enterprise)
- Vanta/Drata (automation-driven, mid-market)
Tip: Start with top 10 suppliers ; then expand.
4. Add Mandatory NIS2 Contractual Clauses
This is one of the biggest changes. NIS2 requires you to enforce cybersecurity obligations contractually.
Your contracts must include:
- security requirements
- logging & monitoring expectations
- incident reporting timelines
- subprocessor transparency
- right to audit or review
- BC/DR expectations
- data location transparency
- exit and transition plans
Anecdote: A financial entity refused a SaaS provider because they could not disclose subprocessors ; regulators would have rejected the relationship anyway.
If a vendor refuses contract obligations → they are not NIS2-compliant for you.
5. Evaluate Cloud & MSP Providers with Extra Rigour
Cloud and MSPs are treated as high-risk dependencies under NIS2.
You must assess:
- region redundancy
- DR capabilities
- outage history
- escalation commitments
- SOC/SIEM integration
- privileged access model
- subcontractors (e.g., 3rd-party DB hosting)
- exit strategy
- data localisation
NIS2 expects deep assurance for cloud and MSPs ; not checkbox questionnaires.
6. Implement Continuous Monitoring (Annual Surveys Are Not Enough)
Vendor risk is not an annual questionnaire anymore. NIS2 expects ongoing oversight.
Continuous monitoring approaches:
- quarterly reviews
- monitoring cloud trust centres / status pages
- watching for CIS security advisories
- automated security scoring (limited but useful)
- reassessment after every major incident
- monitoring subcontractor changes
- continuous SLA review
If you reassess suppliers once a year → you are not NIS2-ready.
7. Build an Exit Strategy for Critical Providers
NIS2 pushes operational resilience ; meaning you must be able to continue operations even if a provider collapses.
An exit plan includes:
- how to export your data
- how to rebuild the service
- alternatives available in the market
- migration effort
- timelines
- technical blockers
- contractual offboarding support
Cloud exit is mandatory.SaaS exit is expected for critical tools.
If you can’t leave a supplier → that supplier is a regulatory risk.
8. Integrate Third-Party Risk Into Your Incident Response Plan
When a supplier has an incident, you have an incident.
Your IRP must include:
- supplier incident escalation contacts
- 24h/72h reporting workflows
- dependency-criticality mapping
- cloud incident scenarios
- MSP breach scenarios
- communication plan
- evidence-handling procedures
A regulator will ask: “How do you handle a breach in a supplier you don’t control?”
You must have the answer documented.
9. Document Everything: Evidence Is What Proves Compliance
NIS2 compliance = ability to show:
- assessments
- contracts
- monitoring logs
- meeting minutes
- remediation steps
- exit plans
- IRP updates
- supplier classification
- dependency maps
If it isn’t versioned and stored in your evidence library → it doesn’t exist.
Final Thought
NIS2 turns supply chain security from a “nice program to have” into a regulatory obligation with teeth.
Compliance requires:
- visibility of dependencies
- prioritisation of suppliers
- structured assessments
- contractual controls
- continuous monitoring
- incident readiness
- exit strategies
- evidence
If you manage your supply chain well, NIS2 becomes an asset. If not, it becomes your organisation’s largest attack surface ; and the regulator’s first concern.
Supply chain security is now part of your operational identity. Treat it as such.
If you want a complete, practical playbook for NIS2 vendor governance ; from classification to exit plans ; that’s exactly what we teach in the Cyber Academy Lead Implementer. Join the next session and secure your digital ecosystem.