NIS 2 Supply Chain: the Basics
NIS 2 Article 21(2)(d) requires regulated companies to take supply chain security measures, including the security side of their relationships with their direct suppliers and service providers. This page covers the basics: what the rule says, who it reaches, what your customers may ask for, and how suppliers prove cybersecurity without becoming a regulated entity themselves.
Why small suppliers are affected by NIS2
NIS2 (Art. 21(2)(d) NIS 2, transposed in Section 30(2) No. 4 BSIG) requires every essential and important entity (around 29,500 in Germany, according to the BSI) to take supply chain security measures, including the security side of its relationships with its direct suppliers and service providers. When choosing those measures it has to take into account each direct supplier's specific vulnerabilities and the overall quality of its suppliers' products and security practices (Art. 21(3)). Contracts are the usual way: the German explanatory memorandum names contractual agreements with suppliers as an example.
If your company has fewer than 50 employees and its annual turnover and balance sheet total are not both above EUR 10 million, you are usually not directly regulated by NIS2. Some entity types are regulated whatever their size, such as trust service providers, DNS providers, TLD registries, small providers of public telecommunications and operators of critical facilities (Section 28 BSIG). If you provide IT services, software, components, logistics or another service to a regulated company, NIS2 requirements can reach you through your contracts.
Section 30(2) No. 4 BSIG: Supply chain security
Regulated entities must take measures for "security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers" (Section 30(2) No. 4 BSIG, transposing Art. 21(2)(d) NIS 2). The duty stays with the regulated entity; a supplier takes on obligations only through what it agrees with that customer.
Contractual requirements
Many NIS2-regulated companies use supplier contracts to meet their supply chain duty; the German explanatory memorandum names agreements on risk management measures, incident handling and patch management as examples. Expect such clauses at the next contract or renewal.
Supplier audits and questionnaires
Your customers may send security questionnaires and may conduct audits. Answers you have already written down are quick to give.
Incident notification obligations
If a security incident at your company causes a significant incident at a NIS2-regulated customer, that customer must report it to the BSI: an early warning within 24 hours, a notification within 72 hours and a final report one month after that (Section 32 BSIG). To meet those deadlines it needs to hear from you quickly.
Competitive advantage
When a regulated company chooses between two suppliers and one can demonstrate NIS2-aligned security while the other cannot: the choice is obvious. Compliance becomes a sales differentiator.
Risk assessment
Identify and document risks to systems you use for customer work. Doesn't need to be complex: a structured list with treatment plans is enough.
Access control
Who can access customer data and systems? Role-based access, MFA for remote access, and documented user management.
Incident handling
A documented process for detecting, responding to and reporting security incidents. No law sets a deadline for a supplier; what you agree with your customer does, and the customer's own clock starts at 24 hours.
Business continuity
What happens if your systems go down? Backup strategy, recovery procedures, and tested plans to continue delivering to your customers.
Policies and evidence
Written security policies, training records, and an audit trail proving you follow your own rules. This is what auditors actually check.
Check your exposure
Use our free applicability check to confirm your NIS2 status. Even if you're not directly in scope, identify which of your customers are NIS2-regulated: those contracts will come with new requirements.
Run a gap assessment
Compare your current security practices against the 10 measures in Section 30 BSIG. Most small companies already do some of this informally: the gap is usually documentation, not practice.
Implement the basics
Start with the highest-impact items: access control, backup strategy, incident response process. The nisd2.eu platform walks you through each requirement with pre-built templates.
Build your evidence package
When your customer sends a security questionnaire, you need answers ready. Policies, training records, risk assessments, and technical measures: all documented and exportable.
Review annually
NIS2 compliance is not a one-time project. Schedule an annual review of your risks, update your policies, and refresh employee training.
Frequently asked questions
Am I legally required to comply with NIS2 as a small supplier?▾
Not directly: NIS2 applies to companies above the EU medium-enterprise threshold (50+ employees OR (over EUR 10M turnover AND over EUR 10M balance sheet total), per Commission Recommendation 2003/361/EC) in a regulated sector. Some entity types are covered whatever their size (Section 28 BSIG). However, your NIS2-regulated customers are legally required to take supply chain security measures (Section 30(2)(4) BSIG, transposing Art. 21(2)(d) NIS-2). Your customer may pass requirements on to you in the contract. You will not be fined by the BSI, but you may lose contracts.
What happens if I don't comply?▾
Your NIS2-regulated customers face fines of up to EUR 10M / 2% of global annual turnover (essential entities) or EUR 7M / 1.4% (important entities) if they fail to meet their supply-chain security duties (Section 65 BSIG). They will either require you to comply or replace you with a supplier who can. The practical consequence is lost business, not a BSI fine.
How much does supplier compliance cost?▾
For a small company the main cost is time. How much depends on what is already in place: the law asks for measures proportionate to the company's risk exposure and size (Section 30(1) BSIG), and a supplier that is not regulated owes only what it agrees with its customers.
Can I use NIS2 compliance as a selling point?▾
Yes. When you can demonstrate NIS2-aligned security practices with documented evidence, you make your customer's supply chain duty easier to meet.
What if my customer hasn't asked yet?▾
They may. The BSI registration deadline passed on 6 March 2026, and supply chain security is one of the 10 measures in Section 30(2) BSIG (No. 4). Getting ahead of the request makes the answer easy when it comes.
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Supply Chain Security
Write down who works for you
A list of your suppliers and service providers.
Supply Chain Security
Record what you have agreed with your suppliers
For each supplier: what does the contract say about security?
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
