You may not be in scope. Your customers are.
The NIS2 Directive, (EU) 2022/2555, applies to essential and important entities across sectors such as energy, transport, banking, health, digital infrastructure and ICT service management. Member States had to apply it from 18 October 2024.
Plenty of software and service providers sell to those entities without being in scope themselves. That doesn't keep NIS2 away from them. Article 21 requires every in-scope entity to manage cybersecurity risk in its supply chain, so the requirement reaches suppliers through the customer relationship.
What Article 21(2)(d) actually requires
Article 21(2) lists the minimum risk-management measures. Point (d) is supply chain security, including the security aspects of the relationship between the entity and its direct suppliers or service providers.
Article 21(3) adds what entities have to weigh when they assess a supplier:
- the vulnerabilities specific to each direct supplier and service provider
- the overall quality of the supplier's products and cybersecurity practices
- the supplier's secure development procedures
How the obligation reaches you
In practice it shows up in three ways: security questionnaires during onboarding and renewal, new contract clauses (incident notification, audit rights, security requirements), and requests for evidence such as certifications, test results and policies.
Management bodies are accountable under Article 20 and the penalties for in-scope entities are significant, so procurement and security teams are increasingly asking for proof rather than accepting a self-assessment.
A questionnaire records what a vendor says
Most supplier reviews still end with a completed questionnaire. It is useful, but it's the vendor describing itself. When an incident or an audit happens, the questions are about evidence: which clause covers incident notification, which report supports the control, and who accepted the remaining risk and why.
That gap between what is claimed and what can be shown is where most review findings come from.
What to do as a supplier
- Map which of your customers are essential or important entities, and in which Member States.
- Keep an evidence pack ready: current certifications, the latest SOC 2 or ISO 27001 report, incident response and notification procedures, and your own sub-processor list.
- Check your standard contract against the clauses customers are now asking for, especially incident notification timelines and audit rights.
- Look one level down. Your customers will ask how you manage your own suppliers.
What to do as the entity asking
If you are the in-scope entity, the work is turning supplier documents into findings you can defend: each gap linked to the clause or report it came from, mapped to the requirement, with a recorded decision. ProcureCortex does this on vendor documents. You can try it on sample data at procurecortex.com/explore (self-serve: email sign-in link, no sales call). The demo labels findings against SOC 2, ISO 27001, GDPR and contract clauses.
Sources
- Directive (EU) 2022/2555 (NIS2 Directive), Official Journal of the EU: https://eur-lex.europa.eu/eli/dir/2022/2555/oj
- European Commission, NIS2 Directive: securing network and information systems: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
Frequently asked questions
Does NIS2 apply directly to SaaS vendors?
Only if the vendor is itself an essential or important entity, for example as a provider of certain digital or ICT services above the size thresholds. Many vendors aren't, but they are still affected through their in-scope customers' supply chain security obligations under Article 21.
What is Article 21(2)(d) of NIS2?
It is the supply chain security measure: in-scope entities must address the security aspects of their relationships with direct suppliers and service providers, taking into account each supplier's vulnerabilities, product quality, cybersecurity practices and secure development procedures (Article 21(3)).
Is a security questionnaire enough to show NIS2 supply chain due diligence?
A questionnaire is a starting point, but it is the supplier's self-assessment. Entities increasingly back it with evidence such as audit reports, certifications and contract clauses, plus a record of the decisions they took on any gaps.
ProcureCortex turns vendor documentation into structured, explainable compliance findings. Explore demo or explore the platform.
