NIS2 for suppliers who aren't in scope
Your company may not fall under NIS2, but your customers might. What that means for the questions you'll be asked and the evidence you'll need.
Rongu team · Published
NIS2 applies to medium-sized and large organisations in a long list of sectors, plus some smaller ones in critical roles. Many software and service companies read the criteria, conclude they are out of scope, and move on. That's often right, and it often misses the point.
Why NIS2 still reaches you
Organisations in scope must manage security risks in their supply chain (Article 21(2)(d)). In practice, they do that by asking their direct suppliers about their security, and by writing requirements into contracts. If you sell to a hospital, an energy company, a bank or a public body, expect the questions.
What they ask
Most supplier questionnaires follow the ten risk-management measures in Article 21:
| Area | Typical question |
|---|---|
| Risk analysis and policies | Do you have an approved information security policy? |
| Incident handling | How and how fast would you notify us of an incident? |
| Business continuity | How often do you back up, and do you test restores? |
| Supply chain | How do you assess your own suppliers? |
| Secure development | How do you handle vulnerabilities? |
| Effectiveness | Do you test your controls, e.g. with penetration tests? |
| Cyber hygiene and training | Do staff receive security awareness training? |
| Cryptography | Is data encrypted in transit and at rest? |
| Access control | How do you grant and remove access? |
| Multi-factor authentication | Is MFA required for remote and admin access? |
Incident notification deserves special care
Entities in scope report significant incidents to their authority in stages: an early warning within 24 hours, a notification within 72 hours and a final report within a month. They need their suppliers to tell them quickly. Write down how you would notify customers, and how fast, before anyone asks.
What to prepare
- A short security policy approved by management.
- An incident response procedure with customer notification steps.
- Backup and restore records.
- A list of your own key suppliers and how you assessed them.
- Evidence for MFA and access reviews.
None of this makes you "NIS2 compliant", because the directive doesn't apply to you directly. It makes you a supplier that customers in scope can work with. If you'd like to answer these questionnaires faster, see NIS2 supplier questionnaires.