NIS2 supplier security: a practical checklist for your vendor list
Most security incidents that make the news don't start inside the company that gets hit. They start at a supplier: a managed service provider, a payroll platform, a software update from a vendor everyone trusted. NIS2, the EU's updated cybersecurity directive, takes that seriously. It doesn't just ask whether your own systems are secure. It asks whether you manage the security risk that comes from your suppliers.
If your organization is in scope, "we have a contract with them" is no longer an answer. You need to show that you assessed the supplier, set expectations, and keep checking. This article explains what that means in practice and gives you a checklist to work through.
What NIS2 actually says about suppliers
The NIS2 Directive (EU) 2022/2555 requires in-scope organizations to take cybersecurity risk-management measures, and supply chain security is named explicitly among them (Article 21), including the security aspects of the relationship with each direct supplier and service provider. When choosing measures, organizations are expected to consider each supplier's specific vulnerabilities, the quality of their products and security practices, and their secure development procedures.
Two other parts of the directive change how this lands inside a company. First, management bodies must approve the measures and oversee them, and can be held accountable (Article 20). Supplier risk is now a board-level topic, not just an IT one. Second, the penalties are significant: up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% for important entities.
Is your company in scope?
NIS2 covers far more sectors than the original NIS rules: energy, transport, banking, health, digital infrastructure, ICT service management, public administration, and a long list of "other critical sectors" such as manufacturing, food, postal services, and waste management. As a rule of thumb, medium and large organizations in those sectors are in scope. And even if you aren't, your customers may be. In-scope companies are pushing supplier security requirements down their supply chain, so you'll likely be asked the same questions.
In the Nordics, NIS2 applies through national law, and the pace has differed: Denmark and Sweden have adopted national NIS2 legislation, while Norway, as an EEA country, has implemented the earlier NIS rules through its Digital Security Act, with NIS2 expected to follow. Check your national authority's guidance for exactly how the rules apply to you.
What "managing supplier risk" looks like in practice
Know who your suppliers are. It sounds obvious, but most companies can't produce a complete list of vendors with access to their systems or data. Contracts sit in folders, SaaS tools are bought on credit cards, and AI tools get adopted by individual teams. You can't assess what you haven't listed.
Tier them by risk. Not every supplier deserves the same scrutiny. A vendor with admin access to your production environment needs far more attention than your office coffee subscription. Rank suppliers by what they touch and what breaks if they fail, and spend your review effort accordingly.
Collect evidence, not promises. Ask for a SOC 2 Type II report or ISO 27001 certificate, and read it. A SOC 2 report's scope and listed exceptions tell you far more than its cover page. Note the dates, because both expire.
Put it in the contract. Incident notification timeframes, security obligations, audit rights, and what happens to your data when the relationship ends. If it isn't in the contract, you'll struggle to enforce it.
Keep checking. A certificate that was valid at signing may have lapsed a year later. Diary expiry dates, review high-risk suppliers at least annually, and re-check when a supplier changes its product or ownership.
Document everything. When a regulator or auditor asks how you manage supplier risk, the answer is a record: who assessed which supplier, when, what evidence they saw, and what was decided. Rebuilding that from email threads after the fact is painful and unconvincing.
A checklist to work through
We've turned this into a practical, printable vendor due diligence checklist covering the whole vendor lifecycle, from the first request to offboarding, with the NIS2 points flagged alongside the EU AI Act, GDPR and DORA ones. It's free, and it's a good way to spot the gaps in your current process.
Where Granur fits
Granur gives every vendor the same front door: a risk-based evaluation before approval, security and certification tracking with expiry alerts, and a secure link vendors use to upload their own SOC 2 reports and certificates, so you stop chasing them by email. Contract obligations and renewal dates are pulled out automatically, and every decision leaves an audit trail. That's the record NIS2 expects you to be able to show.