NIS2 supply-chain risk assessment, built for uneven enforcement

The directive itself has applied at EU level since 18 October 2024, but a directive generally takes legal effect against private entities through each Member State's own transposing law — and transposition is uneven. As of this page's 2 September 2026 review, roughly two-thirds of Member States had completed transposition, while the Commission had referred Ireland, Spain, France and the Netherlands to the Court of Justice for still not having done so. Practically: check whether your own Member State's NIS2 law is actually in force, and don't assume a supplier headquartered in a non-transposed country is automatically unregulated — its own national timeline may differ from yours.

Only if your supplier is one of the specific entity types the regulation covers — DNS providers, TLD registries, cloud, data centre, CDN, managed service and managed security service providers, online marketplaces, search engines, social networking platforms, and trust service providers. For everyone else, Article 21(2)(d)'s supply chain obligation applies without that level of prescribed detail, so 'appropriate and proportionate' measures are a judgment call informed by ENISA's non-binding guidance and your own risk assessment, not a fixed checklist.

Essential entities are generally large organizations (250+ employees, or over €50 million turnover / €43 million balance sheet) in Annex I high-criticality sectors, facing proactive supervision and fines up to €10 million or 2% of global turnover. Important entities are typically medium-sized organizations in Annex I or II sectors, facing reactive supervision and fines up to €7 million or 1.4% of turnover. Some entity types — trust service providers, DNS providers, TLD registries, certain critical infrastructure — are captured regardless of size. Classification affects your own obligations directly and shapes how rigorously you should expect (and can demand) supply-chain assurance from your suppliers.

A certification is useful evidence, not a substitute for an assessment. NIS2's supply chain obligation asks you to assess the security posture of your direct suppliers and service providers in the context of your own risk exposure — a generic ISO 27001 certificate doesn't tell you whether a specific supplier's access to your systems, the criticality of what they provide, or their own sub-supplier dependencies create risk you haven't accounted for. Use certifications as one input to a tiered, risk-based assessment, not as the whole assessment.

NIS2 puts approval and oversight of cybersecurity risk-management measures on the entity's management body, and Member States' transposing laws generally carry through some form of accountability for that body when measures are neglected. Build the vendor risk process so management-level approval and periodic review are documented events, not something that only exists in a compliance team's inbox.

Tie the cadence to risk tier and to trigger events, not a fixed annual calendar alone. A vendor with privileged access to critical systems warrants more frequent review than a low-risk supplier; either way, a material change — a breach disclosure, an ownership change, a new subcontractor, or a significant scope change in what they provide you — should trigger an out-of-cycle reassessment rather than waiting for the next scheduled one.

It's only useful if it changes what happens with the answers. Automating distribution, reminders and response tracking solves a real operational problem — chasing hundreds of suppliers by email doesn't scale — but the value is in automated risk scoring against your own criteria, evidence requests beyond self-attestation for higher-risk vendors, and escalation workflows for non-responsive or high-risk suppliers. A faster way to collect unverified self-attestations isn't a risk-management improvement.