NIS2 Guide

Evaluation of prospective suppliers

Critical

High

Normal

Low

Risk assessment and considerations for contracting ICT services supporting critical functions

Critical

High

Normal

Low

5.2: Directory of suppliers and service providers

The relevant entities shall maintain and keep up to date a registry of their direct suppliers and service providers, including:

contact points for each direct supplier and service provider;
a list of ICT products, ICT services, and ICT processes provided by the direct supplier or service provider to the relevant entities.

Related tasks

Reporting of cybersecurity service providers

Critical

High

Normal

Low

Documenting partners who are related to offered digital services supply chain

Critical

High

Normal

Low

Cloud service management

5.1.7: Monitoring and analysis of supplier and service provider performance

For the purpose of point 5.1.6, the relevant entities shall:

regularly monitor reports on the implementation of the service level agreements, where applicable;
review incidents related to ICT products and ICT services from suppliers and service providers;
assess the need for unscheduled reviews and document the findings in a comprehensible manner;
analyse the risks presented by changes related to ICT products and ICT services from suppliers and service providers and, where appropriate, take mitigating measures in a timely manner.

Related tasks

Periodic review of the supply chain security policy

Critical

High

Normal

Low

Monitoring suppliers' compliance with security requirements

Critical

High

Normal

Low

Managing changes to supplier services

Critical

High

Normal

Low

5.1.6: Monitoring of supplier and service provider practices

The relevant entities shall review the supply chain security policy, and monitor, evaluate and, where necessary, act upon changes in the cybersecurity practices of suppliers and service providers, at planned intervals and when significant changes to operations or risks or significant incidents related to the provision of ICT services or having impact on the security of the ICT products from suppliers and service providers occur.

Related tasks

Periodic review of the supply chain security policy

Critical

High

Normal

Low

Monitoring suppliers' compliance with security requirements

Critical

High

Normal

Low

Managing changes to supplier services

Critical

High

Normal

Low

5.1.5: Integration of security criteria in supplier selection and procurement

The relevant entities shall take into account the elements referred to in point 5.1.2 and 5.1.3 as part of the selection process of new suppliers and service providers, as well as part of the procurement process referred to in point 6.1.

Related tasks

Evaluation of prospective suppliers

Critical

High

Normal

Low

General rules for the procurement of data systems

Critical

High

Normal

Low

Data system procurement

5.1.4: Supply chain contractual security obligations

Based on the supply chain security policy and taking into account the results of the risk assessment carried out in accordance with point 2.1 of this Annex, the relevant entities shall ensure that their contracts with the suppliers and service providers specify, where appropriate through service level agreements, the following, where appropriate:

cybersecurity requirements for the suppliers or service providers, including requirements as regards the security in acquisition of ICT services or ICT products set out in point 6.1;
requirements regarding awareness, skills and training, and where appropriate certifications, required from the suppliers’ or service providers’ employees;
requirements regarding the verification of the background of the suppliers’ and service providers’ employees;
an obligation on suppliers and service providers to notify, without undue delay, the relevant entities of incidents that present a risk to the security of the network and information systems of those entities;
the right to audit or right to receive audit reports;
an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities;
requirements regarding subcontracting and, where the relevant entities allow subcontracting, cybersecurity requirements for subcontractors in accordance with the cybersecurity requirements referred to in point (a);
obligations on the suppliers and service providers at the termination of the contract, such as retrieval and disposal of the information obtained by the suppliers and service providers in the exercise of their tasks.

Related tasks

Security agreement with a supplier

Critical

High

Normal

Low

Process for handling and sharing vulnerability disclosures

Critical

High

Normal

Low

Documentation of partner contract status

Critical

High

Normal

Low

Requiring a system description from suppliers of important information systems to be acquired

Critical

High

Normal

Low

Data system procurement

5.1.1: Supply chain security policy

For the purpose of Article 21(2), point (d) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a supply chain security policy which governs the relations with their direct suppliers and service providers in order to mitigate the identified risks to the security of network and information systems. In the supply chain security policy, the relevant entities shall identify their role in the supply chain and communicate it to their direct suppliers and service providers.

Related tasks

No items found.

5.1.3: Consideration of coordinated supply chain risk assessments

When establishing their supply chain security policy, relevant entities shall take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1) of Directive (EU) 2022/2555, where applicable.

Related tasks

Ensuring supply chain security

Critical

High

Normal

Low