NIS2 for suppliers: you are not designated, but your customers are

How NIS2 reaches a supplier that was never designated

NIS2 applies directly only to organisations it classifies as essential or important entities, by sector and size. If you are not one of them, no national authority will send you a compliance order. That is where many suppliers stop reading, and where the misunderstanding begins.

The directive does not regulate your suppliers' suppliers directly. Instead it makes each in-scope entity responsible for the cybersecurity risk in its own supply chain (Article 21(2)(d)). To discharge that duty, your customers must assess, set requirements for and monitor the security of the suppliers they depend on. If you are one of those suppliers, their legal obligation becomes your commercial one. You are pulled in indirectly, through the relationship rather than through a designation.

What your in-scope customer is required to do, and why it lands on you

Article 21(2)(d) requires essential and important entities to manage supply chain security, including the security-related aspects of the relationship between each entity and its direct suppliers or service providers. In practice your customer has to:

• Identify which suppliers are critical to its services and assess the cyber risk each one introduces.
• Set security requirements for those suppliers and write them into contracts and data processing agreements.
• Verify that the requirements are met, not once at onboarding but on a continuing basis.
• Account for incidents that originate with a supplier, because under NIS2 a supplier-caused disruption is still the customer's incident to handle and report.
• Show its supervisory authority evidence that this supplier oversight actually happens.

What your customers will ask you for

As that oversight matures, the requests landing on suppliers are converging on a recognisable set:

• A security questionnaire or self-assessment, often mapped to the NIS2 Article 21(2) measures or to a standard such as ISO 27001.
• Evidence behind the answers: policies, certificates and recent test or scan results, rather than unsupported claims.
• An incident-notification clause committing you to alert the customer quickly when something affects them, so they can meet their own reporting deadlines.
• Contractual security requirements and, for critical suppliers, a right to audit or to request independent assurance.
• Acceptance of continuous external monitoring, because a point-in-time questionnaire answered last year no longer satisfies a continuing-basis obligation.

The Article 21(2) measures your customers expect you to have

Even though Article 21(2) binds your customer rather than you, its ten measures are the template most buyers reuse when they set requirements for suppliers. It is worth being able to show, in your own proportionate way, that you address each:

Incident reporting flows in both directions

NIS2 gives in-scope entities a tight clock: an early warning within 24 hours, a fuller notification within 72 hours and a final report within a month (Article 23). They cannot meet that clock if a supplier sits on bad news. So their contracts increasingly require you to notify them promptly when an incident affects, or could affect, the services you provide them.

For an undesignated supplier the practical consequence is simple: you need your own incident process, with clear internal escalation and a defined way to inform affected customers, so that a problem on your side does not become a missed deadline on theirs. A supplier that detects, contains and communicates well is far easier to keep than one that goes quiet.

A requirement worth treating as an advantage

It is easy to read all of this as a burden imposed by someone else's regulation. The suppliers that do best read it the other way. As more buyers fall under NIS2 and tighten their supply-chain checks, the ability to answer a security questionnaire quickly, with evidence, becomes a reason to win and keep business rather than a hurdle to clear.

The reverse is also true and quieter: suppliers who cannot demonstrate their posture are increasingly filtered out at procurement, often without being told why. Getting ahead of the questions, before a customer asks, turns NIS2 from a compliance cost into a sales asset.

How to respond credibly

You do not need to become an essential entity overnight. You need to be ready for the questions and able to back your answers. A proportionate path:

• Know your own external posture first: domains, certificates, email authentication, exposed services and known vulnerabilities, the same things a customer's assessment will look at.
• Close the common gaps that questionnaires and scans flag: enforce TLS 1.2+, publish SPF, DKIM and DMARC, patch promptly, require MFA, and remove exposed admin interfaces.
• Write down the basics: a short information security policy, an incident process and a record of who owns security. Evidence beats assertion.
• Keep your answers current. Treat assurance as continuous, because that is increasingly how your customers treat it.
• If you serve larger or regulated buyers, consider ISO 27001 or an equivalent as a recognised shorthand, but do not wait for it to start.

How norppa.io helps

norppa.io gives an undesignated supplier the same continuous, evidence-backed view of its security that a NIS2 customer now expects to see. Your domains are checked across more than a hundred control points daily, the time-sensitive ones every six hours, and each finding is mapped to the NIS2 article it relates to, so you can answer a questionnaire with current evidence rather than assertions.

The self-assessment questionnaire captures your process and contractual controls, and each answer is set against the live technical profile, so when a customer's procurement team asks for proof you can hand over a clear, corroborated picture instead of a spreadsheet that was true last spring.