Does NIS2 apply to suppliers? What a small supplier needs when its customer is in scope

Check 1: are you in scope yourself?

The NIS2 Directive (EU) 2022/2555 covers entities in the sectors of its Annexes I and II that are medium-sized or larger. Under the EU SME definition that means 50 or more staff, or both annual turnover and balance sheet above €10 million. Some types are covered whatever their size, including providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers (Article 2(2)). A member state can also designate a smaller entity, for example when it is the sole provider of an essential service in that country.

Watch out if you are an IT company with 50 or more staff: managed service providers and managed security service providers are listed in Annex I. If none of this applies to you, NIS2 gives you no registration or incident-reporting duty toward a national authority. Your obligations are the ones you agree with your customer.

Check 2: how it reaches you anyway

Article 21(2)(d) requires essential and important entities to take measures on "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers". Article 21(3) adds that they must take into account the vulnerabilities specific to each direct supplier, the overall quality of its products and its cybersecurity practices, including secure development procedures.

For a group of digital entities, such as cloud and data centre providers, managed service providers and online marketplaces, Commission Implementing Regulation (EU) 2024/2690 spells these measures out in more detail. For other customers, the national implementing law and the customer's own policy decide what they ask. In practice it reaches you in three ways: a security questionnaire, contract clauses (incident notification, audit rights, passing requirements on to your own suppliers) and requests for evidence. How to answer the questionnaire itself is covered in How to answer a NIS2 supplier security questionnaire.

What your customer is likely to ask about

The ten areas of Article 21(2) are the natural checklist, because your customer has to cover them itself:

1. risk analysis and information system security policies;
2. incident handling;
3. business continuity, backups and disaster recovery;
4. supply chain security;
5. security in acquisition, development and maintenance, including vulnerability handling;
6. assessing whether the measures work;
7. basic cyber hygiene and cybersecurity training;
8. cryptography and encryption;
9. human resources security, access control and asset management;
10. multi-factor authentication and secured communications.

A small supplier rarely needs all ten in depth. What you touch decides the weight. Remote admin access, hosting the customer's data or building its software make access control, MFA, vulnerability handling and incident notification the questions that matter most.

What to have ready: five items

1. A short security policy structured along the same ten areas, dated and signed off by management. Mark the areas that do not apply to your service and say why.
2. A self-assessment. Per area: in place, partly or not yet, with a target date for each gap. It gives you honest answers and a plan in one document.
3. An incident notification procedure toward customers. Who notices, who decides, who informs the customer, through which channel and within what time. Your customer has deadlines of its own: under Article 23 an early warning to its CSIRT or authority within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. It will want to hear from you quickly.
4. Standard answers to the questions customers commonly ask, each with a reference to the evidence behind it.
5. Evidence you can share safely: a screenshot of an MFA setting, the record of your last restore test, a training list with dates, a certificate if you have one. Never passwords, full network diagrams or open vulnerabilities.