What NIS2 means for your supply chain
If your company sells to, buys from, or simply supports another business in the European Union, the NIS2 directive has probably already reached you, even if nobody sent you a letter about it. The rules on NIS2 supply chain security are the part of the directive most likely to affect small and medium businesses, because they push obligations down through contracts rather than through registration lists. A logistics firm, a software house, a managed service provider, or a company that maintains industrial equipment can all end up inside the scope of somebody else’s compliance programme.
Directive (EU) 2022/2555, better known as NIS2, replaced the original 2016 network and information security rules and widened the field considerably. Where NIS1 covered roughly 400 entities in Italy, estimates for NIS2 put the number of directly regulated organisations in the tens of thousands across the country. ACN, the Italian national cybersecurity agency, registered more than 20,000 entities during the first registration window that closed in early 2025, and the indirect reach through suppliers is a multiple of that figure.
The directive dedicates specific attention to supply chain risk. Article 21 lists supply chain security among the minimum risk management measures every essential and important entity must adopt, including the security of relationships with each direct supplier and service provider. In plain terms: your customer is now legally required to care about how you handle security, and to prove it.
Why suppliers became the weak point
The reasoning behind the rules is uncomfortable but sound. Attackers rarely go through the front door of a well defended organisation when a smaller partner holds the same access with a fraction of the controls. ENISA has repeatedly flagged supply chain compromise as one of the top threats facing European organisations, and incident data from the last few years shows third party involvement in a growing share of breaches.
For SMBs this creates an odd asymmetry. A 15 person company may hold VPN credentials into a utility, a hospital, or a public administration network. The attacker gets the same result by compromising the small firm, at a much lower cost. That is precisely the gap NIS2 is trying to close.
There is also a practical business dimension. Even if your company is not directly in scope, larger clients will ask you to demonstrate a security posture as a condition of doing business. Contracts are already being rewritten across Italy and the rest of the EU with security annexes, audit rights, and incident notification clauses attached. Losing a tender because you cannot answer a security questionnaire is a commercial problem long before it becomes a regulatory one.
The 24 hour clock
One clause deserves particular attention from smaller suppliers. NIS2 requires regulated entities to send an early warning to the national CSIRT within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. If the incident originates in your systems, your client cannot meet that deadline unless you tell them fast.
This is why supplier contracts increasingly specify notification windows of 12 or even 6 hours. It is not paperwork for its own sake: the client is passing along a legal obligation they cannot renegotiate. Make sure someone in your organisation is reachable and authorised to make that call, including at night and in August.
NIS2 supplier risk management in practice
Effective NIS2 supplier risk management starts with knowing who your suppliers actually are. Most SMBs discover, when they finally build the list, that it is longer than expected: cloud services bought with a corporate card, a freelance developer with repository access, a maintenance firm with remote desktop credentials, a payroll provider holding personal data.
Build the inventory first, then classify. A useful split is three tiers: suppliers with access to your systems or data, suppliers whose failure would stop your operations, and everyone else. The first two groups deserve real scrutiny; the third can be handled with standard contract terms.
For critical suppliers, ask for evidence rather than declarations. Certifications such as ISO/IEC 27001 or SOC 2 are a reasonable starting signal, but they are not the whole answer, because the scope of a certificate can be narrower than the service you are buying. Ask what is actually covered, how incidents are handled, where data is stored, and who has administrative access.
Contract clauses that matter
Three clauses do most of the work. First, an incident notification obligation with a defined deadline and a named contact. Second, an audit or evidence right, which in practice usually means the supplier agrees to answer a questionnaire and share relevant reports annually. Third, a subcontracting clause: the supplier must tell you when critical work moves to a fourth party.
Add a right to terminate for persistent security failures. It is rarely used, but its presence changes how seriously the other side treats remediation requests. Keep the language proportionate to the size of the contract, since a disproportionate annex simply gets ignored or refused.
Access control and segmentation
Contracts are only half the story. The technical side of supplier risk comes down to limiting what a compromised partner can reach. Give each supplier its own named accounts rather than shared ones, apply multi factor authentication without exceptions, and remove access when a project ends rather than when someone remembers.
Time bound access is particularly effective for maintenance vendors: the account is enabled for the intervention window and disabled afterwards. Combined with network segmentation, this turns a supplier compromise from a company wide event into a contained one. Our cybersecurity services cover this kind of access governance for organisations that do not have a dedicated security team.
Traceability: SBOM, AIBOM, and knowing what you run
A significant part of modern supply chain risk is not a company at all, it is code. The average business application pulls in hundreds of open source components, most of them installed without anyone deciding to install them. When a vulnerability like Log4Shell appears, the first question is always the same: do we use it, and where?
The Software Bill of Materials (SBOM) answers that question. It is a machine readable inventory of every component inside a piece of software, with versions and dependency relationships, typically in CycloneDX or SPDX format. The Cyber Resilience Act will make SBOMs mandatory for products with digital elements sold in the EU, with main obligations applying from December 2027, so software vendors should be preparing now rather than later.
For a company buying software, the practical move is to request SBOMs from your critical vendors and store them where your security process can actually use them. For a company producing software, generating an SBOM in the build pipeline is a small engineering task with a large commercial payoff, because it will soon be a standard procurement requirement.
Adding AI to the picture
The same logic is now extending to artificial intelligence with the AIBOM, an inventory of the models, training data sources, and inference services behind an AI feature. If a supplier processes your data through a model, you need to know which model, hosted where, and under what terms regarding retention and training.
This matters more than it may seem. Many SMBs have adopted AI assistants and automation tools quickly, often without a formal review. Under NIS2 those tools are part of your information system, and under the AI Act some of them carry additional obligations. Documenting them now costs far less than reconstructing the picture during an audit or an incident.
What businesses need to do next
Start with scope. Determine whether your organisation falls directly under NIS2 as an essential or important entity, which depends on sector and size (generally 50 or more employees or 10 million euro turnover, with exceptions that capture smaller firms in critical roles). If you are not directly in scope, identify which of your clients are, because their obligations become your requirements.
Then assign responsibility. NIS2 makes management bodies accountable for approving risk measures and requires them to receive training, with penalties reaching 10 million euro or 2 percent of global turnover for essential entities. This is not a topic that can be left entirely to whoever manages the IT.
From there, work through the basics in order: asset and supplier inventory, access control and MFA, backup and recovery testing, incident response with named roles and notification timelines, logging that would let you reconstruct an event, and staff awareness training. Our overview of NIS2 compliance breaks these requirements down step by step, and organisations working with the public sector will find sector specific guidance in our public administration solutions.
Finally, treat this as an operational programme rather than a document. The organisations that get real value from NIS2 are the ones that use it as a reason to fix things they already knew were weak: the shared admin password, the backup nobody has restored from, the supplier whose contract expired in 2021. Compliance follows resilience far more easily than the other way around.