NIS2 Supply Chain Security Guide: Article 21(2)(d) Supplier Controls

NIS2 makes supply chain security one of the ten minimum cybersecurity measures, but the Directive itself gives it a single line, so most entities are unsure what a supervisor will expect to see. Article 21(2)(d) of Directive (EU) 2022/2555 requires measures covering "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers". Article 21(3) says what to weigh, Commission Implementing Regulation (EU) 2024/2690 spells out the policy, contract terms and supplier directory for digital infrastructure and digital provider sectors, and ENISA's June 2025 technical implementation guidance adds evidence examples. This guide joins those layers into one supplier control set, with a rollout plan and the evidence to keep. It is for security, procurement and third-party risk teams at essential and important entities. For NIS2 as a whole see the NIS2 Directive Guide.

Key takeaways

• Direct suppliers are the legal scope. Article 21(2)(d) and 21(3) speak of direct suppliers and service providers; deeper tiers are reached through contract flow-down, not directly.
• Article 21(3) sets four things to weigh. Each direct supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices, its secure development procedures, and the results of EU coordinated risk assessments under Article 22(1).
• The implementing regulation is the detailed checklist. Annex section 5 of Regulation 2024/2690 requires a supply chain security policy, selection criteria, eight contract topics, ongoing monitoring and a supplier directory; it binds listed digital sectors directly and is a strong reference for everyone else.
• Acquisition is a separate measure. Article 21(2)(e) and Annex point 6.1 cover what you buy: security requirements, lifetime updates, component information and validation on delivery.
• Management carries the liability. Article 20(1) requires management bodies to approve and oversee the Article 21 measures, and Article 34 sets fine maxima of at least EUR 10 million or 2% of turnover for essential entities and EUR 7 million or 1.4% for important entities.

The legal layers and who they bind

Entities in sectors outside the implementing regulation still have to meet Article 21(2)(d). Using the regulation's Annex as the reference model is our recommendation: it is the most detailed official statement of what "supply chain security" means under NIS2.

The supplier control set, point by point

Annex section 5 of Regulation 2024/2690, paraphrased, with ENISA's evidence examples where the guidance gives them:

ENISA's guidance for point 5.2 suggests reviewing the directory at least annually or after significant change, recording contract start and end dates and each supplier's region, and classifying suppliers (for example critical, strategic and routine) by factors such as asset sensitivity, availability needs, applicable regulation and inherent and mitigated risk. See the Vendor Tiering and Inherent Risk Questionnaire Template.

Contract terms under Annex point 5.1.4

The implementing regulation lists eight topics that contracts should specify where appropriate:

1. Cybersecurity requirements for the network and information systems or services, including the secure acquisition requirements in point 6.1.
2. Awareness, skills and training required of the provider's staff, and certifications where relevant.
3. Background verification requirements for the provider's staff.
4. Prompt notification of incidents that present a risk to the security of your network and information systems.
5. Right to audit or right to receive audit reports.
6. Vulnerability handling for vulnerabilities that present a risk to your systems.
7. Subcontracting rules and, where permitted, cybersecurity requirements for subcontractors.
8. End of contract obligations, such as retrieval and disposal of information obtained in performing the contract.

ENISA's tips widen this with clauses familiar from financial regulation: clear service descriptions and service levels, data locations with advance notice of changes, incident assistance with named roles and contacts, cooperation with authorities, termination rights and notice periods, and exit with a transition period. Entities also in scope of DORA should use one clause set for both; see the DORA Article 30 Contract Provisions Guide and the Third-Party Security Contract Clauses Template.

Secure acquisition: the Article 21(2)(e) half

Supplier relationships and the products you buy are separate measures. Annex point 6.1 requires processes, based on your risk assessment, to manage risks from acquiring ICT services or products for components critical to security, across the full life cycle. Point 6.1.2 lists what those processes include:

• Security requirements for the service or product being acquired.
• Security updates for the whole lifetime, or replacement after end of support.
• Component information: the hardware and software components used. A software bill of materials is a practical way to receive this; see the SBOM Guide.
• Security functions and secure configuration information.
• Assurance that the product or service meets the requirements, and validation on delivery with documented results.

For products with digital elements, the EU Cyber Resilience Act will place matching duties on manufacturers; see the EU Cyber Resilience Act Guide. ENISA's guidance also covers free and open source components: ask suppliers to assess FOSS risk before integrating components, show timely security updates and use dependency management.

Where identity fits: supplier access and credentials

Many supplier risks reach you as identities: managed service provider administrator accounts, remote support tools, API keys issued to integrations, and service accounts that suppliers run in your environment. Annex section 5 does not name them, but ENISA's guidance says secure decommissioning should cover account deactivation, data flow termination and secure data disposal, and Annex point 11.2.2(d) (management of access rights) requires access rights for third parties, including suppliers and service providers, to be limited in scope and duration. Our recommended additions to the policy:

• Record supplier credentials in the directory: for each direct supplier, the accounts, keys and tokens it holds in your systems and those it has issued to you. See the Third-Party Credential Register Template.
• Time-box access: just-in-time or expiring access for supplier administrators, and named accounts rather than shared ones. See the Third-Party Access Guide.
• Revoke at exit: make credential revocation and attestation a step in end-of-contract obligations (point 5.1.4(h)). See the Vendor Offboarding and Termination Guide.

How to implement: a phased approach

1. Build the directory (months 1 to 2). Start from accounts payable, contract and SSO data to list direct suppliers; add contact points, the products and services each provides, contract dates and region.
2. Tier suppliers (months 2 to 3). Classify by criticality using the factors ENISA suggests. Only the top tier gets full assessments and contract remediation in year one.
3. Write the policy (month 3). Cover points 5.1.1 to 5.1.7, your role in the supply chain, the Article 21(3) factors and how coordinated risk assessments are considered. Have the management body approve it (Article 20(1)).
4. Remediate contracts (months 3 to 12). Use a security addendum for the eight 5.1.4 topics, starting with critical suppliers at renewal or sooner where risk is high. Pilot the addendum with a few suppliers of different sizes first.
5. Embed in procurement (month 4 onward). Add the 5.1.2 criteria and 6.1.2 requirements to sourcing templates so new contracts start compliant.
6. Monitor and review (ongoing). SLA and security report reviews, supplier incident tracking and unscheduled review triggers (point 5.1.7); review the directory and policy at least annually.

Rollback is procedural: keep the previous policy and contract versions until the new ones are approved and signed, and record exceptions with an owner and expiry rather than pausing the programme.

Decision guidance

• In a 2024/2690 sector or not: listed digital providers must meet the Annex directly. Others should still use it as the reference model, scaled to their risk, and check national transposition for added rules.
• Audit or report: for large multi-tenant suppliers, rights to receive audit reports and certifications (point 5.1.4(e)) are realistic; keep a direct audit right for critical, smaller suppliers.
• Small entities: Article 21(1) proportionality allows a lighter process (a short critical supplier list, a one-page policy, a standard addendum) but not omitting supply chain security.
• Entities also under DORA: NIS2 Article 4 lets sector-specific EU acts with at least equivalent requirements apply instead, and NIS2 recital 28 says DORA should be considered such an act for financial entities; see the DORA and NIS2 Overlap Mapping Guide.

Detection and measurement

Our suggested metrics: direct suppliers in the directory with a contact point and tier (target 100%); critical suppliers with a current assessment and a signed security addendum (target 100% within 12 months); supplier-related incidents and the share that triggered an unscheduled review; supplier credentials with an owner and expiry; and median days to revoke supplier access at contract end.

Framework mapping

For deeper supplier frameworks see the ISO/IEC 27036 Supplier Relationships Guide and the NIST SP 800-161 Cyber Supply Chain Risk Management Guide.

Common failure patterns

• A directory that is a procurement list: without contact points and the products and services each supplier provides, point 5.2 is not met.
• Policy with no supplier-facing role statement: point 5.1.1 also asks you to state and communicate your own role in the supply chain.
• Contracts remediated only at renewal: long contracts leave critical suppliers without notification and audit terms for years; prioritise by risk.
• Selection without the Article 21(3) factors: price and functionality scoring that ignores secure development and product quality.
• Monitoring that never triggers: no defined triggers for unscheduled reviews, so supplier incidents do not change anything.
• Supplier access outliving the contract: accounts and keys left active after exit, despite the end-of-contract duty.

Practitioner checklist

• Build a directory of direct suppliers with contact points, products and services, dates and region.
• Tier suppliers by criticality and review the tiers at least annually.
• Write a management-approved supply chain security policy covering Annex points 5.1.1 to 5.1.7.
• Record how the Article 21(3) factors and any Article 22 coordinated assessments are considered.
• Add the eight 5.1.4 contract topics to an addendum and roll it out to critical suppliers first.
• Put 6.1.2 acquisition requirements, including component information and lifetime updates, into procurement templates.
• Define unscheduled review triggers and log supplier-related incidents.
• Track supplier-held credentials and revoke them at contract end.

Standards and references

• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• EUR-Lex: Commission Implementing Regulation (EU) 2024/2690
• ENISA: NIS2 Technical Implementation Guidance
• NIST: Cybersecurity Framework (CSF) 2.0
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

This guide summarises the NIS2 supply chain security requirements and is not legal advice. Related NHI Mgmt Group resources: NIS2 Implementing Regulation 2024/2690 Guide · Supplier Security Policy Template · Third-Party Risk Management Guide · NIS2 Readiness Checklist