NIS2 and your supplier register: where to start
NIS2 makes supply chain security part of your own risk management. A simple way to sort suppliers into tiers before you send a single questionnaire.
Verified
NIS2 asks essential and important entities to manage cybersecurity risk in their supply chain, not just in their own systems. For most teams the hard part is not the questionnaire. It is knowing which suppliers deserve one.
Measures shall include supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
NIS2 Directive, Article 21(2)(d)
Start with a tiering model
Sort suppliers by what happens if they fail, not by how much you spend with them. Four tiers is usually enough:
| Tier | Typical supplier | What you ask for | Review |
|---|---|---|---|
| 1 – Critical | Hosting, core IT, payment providers | Full questionnaire, certificates, incident contacts | Yearly |
| 2 – High | SaaS tools holding personal or customer data | Short questionnaire, certificates | Yearly |
| 3 – Medium | Consultants with system access | Security declaration | Every two years |
| 4 – Low | Office supplies, facilities | Nothing beyond the contract | On renewal |
Then work tier by tier
- Export your supplier list from finance and remove one-off vendors.
- Agree the tier criteria with IT and procurement in one meeting.
- Tier the list, starting with anything that touches production systems.
- Send requests to tier 1 first, and leave the rest for the following quarter.
You will not get the register perfect on the first pass. A tiered list you can defend is worth more than a complete one you can't.