NIS2 and your supplier register: where to start

Written by Verified | Nov 11, 2026, 11:18:48 AM

NIS2 asks essential and important entities to manage cybersecurity risk in their supply chain, not just in their own systems. For most teams the hard part is not the questionnaire. It is knowing which suppliers deserve one.

Measures shall include supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
NIS2 Directive, Article 21(2)(d)

Start with a tiering model

Sort suppliers by what happens if they fail, not by how much you spend with them. Four tiers is usually enough:

Tier	Typical supplier	What you ask for	Review
1 – Critical	Hosting, core IT, payment providers	Full questionnaire, certificates, incident contacts	Yearly
2 – High	SaaS tools holding personal or customer data	Short questionnaire, certificates	Yearly
3 – Medium	Consultants with system access	Security declaration	Every two years
4 – Low	Office supplies, facilities	Nothing beyond the contract	On renewal

Then work tier by tier

Export your supplier list from finance and remove one-off vendors.
Agree the tier criteria with IT and procurement in one meeting.
Tier the list, starting with anything that touches production systems.
Send requests to tier 1 first, and leave the rest for the following quarter.

You will not get the register perfect on the first pass. A tiered list you can defend is worth more than a complete one you can't.

View full post