The supply-chain clause, line by line.
Article 21(2)(d) is the NIS2 obligation that pushes responsibility outward — making your security posture partly dependent on the security of the suppliers you depend on. This page is a practitioner reference: the exact directive language, what it actually obliges, what evidence holds up, and a worked example for a hypothetical Slovak utility.
What the directive actually says.
From Article 21 of Directive (EU) 2022/2555: essential and important entities shall take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems (paragraph 1). Paragraph 2 lists what those measures include at least, and point (d) names supply chain specifically:
"supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers"
Article 21(2)(d) — NIS2 Directive 2022/2555
That is a deceptively short sentence. The rest of this page unpacks what regulators have started to mean by it, what evidence holds up under scrutiny, and what is easy to miss when you try to satisfy it.
What "direct suppliers and service providers" actually covers.
The clause names "direct suppliers" — the companies you have a contract with. But Recital 85 expands the practical scope. Covered entities should consider:
"the overall quality and resilience of products and services, the cybersecurity risk-management measures embedded in them, and the cybersecurity practices of their suppliers and service providers, including their secure development procedures."
Recital 85 — NIS2 Directive 2022/2555Read on EUR-Lex
Two things hide in that recital. First — you are not just buying a product or service; you are inheriting the security posture of the people who built it. Second — its last sentence reaches past the first link: entities "could consider risks stemming from other levels of suppliers and service providers", in practice your suppliers' own suppliers, such as sub-processors. The directive does not ask you to audit the entire chain: Article 21(2)(d) names your direct suppliers and service providers, and the recital says only that you "could" look further.
In practice, the direct/indirect distinction matters less than the criticality distinction. A printer maintenance contractor is technically a direct supplier; nobody expects you to do the same depth of work on them as on the cloud platform that hosts your customer data.
Five evidence artefacts that cover most of the clause.
The directive deliberately leaves the how open — measures "appropriate" to the risk. Across early competent-authority guidance and auditor questions, the operational baseline collapses to these five artefacts — "most" is our judgement, not a measured statistic.
A maintained supplier inventory tagged by service and data
Every supplier handling regulated services or processing regulated data, with the service named and the data type tagged. Live, not a spreadsheet in someone's email. Sub-processors of those suppliers identified separately.
A documented risk classification
Four tiers (Low, Medium, High, Critical), each set by the supplier's strongest single risk across six areas: availability, confidentiality, privileged access, supply chain, jurisdiction and resilience. Higher tiers get the full assessment; lower tiers get a lighter touch, but the lighter touch is documented, not absent.
Per-supplier assessment evidence on a known cadence
For each supplier: what you asked, what they answered, what evidence they provided (SOC 2, ISO 27001, sub-processor list, security policy, incident history, business continuity plan), who reviewed it on your side, when, and when it next needs re-reviewing.
A defensible decision trail
Approving a supplier is easy. Showing — three years later, after staff turnover, possibly under regulator scrutiny — how you approved them, on what evidence current at the time, and who signed: that's the part that takes infrastructure. This is the artefact that is hardest to rebuild after the fact.
A reaction plan for material change
Suppliers' postures drift. Certificates expire. Sub-processors are added without notice. Incidents happen mid-cycle. Implementing Regulation (EU) 2024/2690 (Annex points 5.1.6 and 5.1.7) has the entities it covers, and in Austria every essential and important entity, act on such changes when they occur, not only at planned intervals; for everyone else, treating them as first-class triggers, rather than waiting for next year's annual review, is the sensible reading of "appropriate and proportionate".
The five artefacts, and how to build them
The free NIS2 supplier review kit helps you build all five in four steps: which suppliers matter, how much risk each one brings, what evidence you hold, and what you decided. One checklist per step, and a one-page policy to fill in.
Download the kit (PDF)No email needed. Version 1.2.
How a 300-person Slovak utility implements 21(2)(d).
Hypothetical and illustrative — not a description of any real organisation. Its numbers are illustrations, not recommendations.
The entity is a 300-person regional water utility headquartered near Žilina. Drinking water is an Annex I sector and, at 300 staff, it exceeds the medium-size ceilings, so it is an essential entity under Slovakia's NIS2 transposition (Act No. 366/2024), in force since 1 January 2025. Its supervisory authority is the Národný bezpečnostný úrad (NBÚ).
Its supplier portfolio is small but high-stakes — roughly 35 suppliers in scope. The top of the list: the supervisory control and data acquisition (SCADA) platform supplier, the smart-meter management cloud, the managed service provider (MSP) that runs the billing system, the geographic information system, and a handful of hardware integrators that touch the operational technology (OT) network during maintenance windows. Each of those carries a sub-processor list that adds another 60–80 entities the utility has to consider, even if not formally assess.
The implementation of the five artefacts:
- 01The inventory lives in a single register, owned by the IT lead. Each supplier tagged by the OT zone they touch and the data classification they handle. Sub-processors of the SCADA platform and the smart-meter cloud are listed separately, refreshed quarterly against the supplier's published list.
- 02Four tiers — Critical (SCADA, smart-meter cloud, billing MSP), High (the geographic information system and the hardware integrators with OT access), Medium (the rest of the regulated-data touchers), and Low (everyone else). Tier assignments are signed by the IT lead and reviewed by the management body annually.
- 03Critical-tier suppliers are reassessed every 6 months — SOC 2 Type II, sub-processor list, incident history, business-continuity test results, contract clauses verified. High-tier annually, with the same checks. Medium-tier annually, with lighter ones. Low-tier attestation-only at contract renewal.
- 04Decisions are recorded with the date, the evidence package they were based on, the named reviewer, and the next review date. Earlier decisions stay on file; each review adds a new one. This is the artefact an inspector is likely to ask for early.
- 05Material-change triggers documented: an incident the supplier reports, sub-processor addition, certificate expiry, change of corporate ownership. Each triggers an out-of-cycle review with a named owner and a 30-day completion target.
Most of this utility's NIS2 supplier-assurance effort would go to the Critical and High tiers. The structure exists for the rest, scaled appropriately.
Four claims that do not satisfy the clause.
"We have a SOC 2, so we're covered."
SOC 2 is a control-effectiveness audit on the supplier — evidence about their posture. It is necessary, often. It is not the same as YOU having assessed and decided. Article 21(2)(d) is asking you to make a decision about them; the SOC 2 helps but does not substitute.
"We do an annual review, that's enough."
Annual works for stable suppliers in stable contexts. It does not work for cloud platforms that update sub-processors quarterly, or for services where an incident is reported mid-cycle. The directive asks for measures appropriate to the risk; for the provider types it names, and in Austria for every essential and important entity, Implementing Regulation (EU) 2024/2690 has them act on material change, not only at calendar dates — and that is the sensible reading for everyone else.
"We're a small business — the depth expected is lower."
The proportionality principle is real — a 50-person manufacturer is not expected to run the same machine as a tier-one bank. But the FORM of the obligation is the same. Inventory, classification, assessment, decision trail, reaction plan. The depth scales; the structure does not.
"Our customer's questionnaire is the assessment."
No. Answering a customer's questionnaire is evidence about you that they use to assess you. It is not your assessment of your suppliers. If a regulator audits you, they will want to see how you assessed Supplier X — not how Customer Y assessed you.
Where to verify everything on this page.
The directive itself is the source of truth. The European Union Agency for Cybersecurity (ENISA) and the NIS Cooperation Group are the two bodies producing the operational guidance auditors are starting to use. None of these are commercial sources — verifiability is the point.
- NIS2 Directive (2022/2555)
Article 21(2)(d) and Recital 85 — the load-bearing clauses for supply-chain risk-management.
- Browse the ISO 27001 / NIST mapping on this site →ENISA Technical Implementation Guidance v1.0
The European Union Agency for Cybersecurity's practitioner guidance on implementing NIS2 risk-management measures, including supply-chain.
- NIS Cooperation Group ICT Supply Chain Toolbox
The NIS Cooperation Group's toolbox, published in February 2026: a common approach to identifying, assessing and mitigating cybersecurity risks in ICT supply chains.
The five artefacts, in the product.
Vittnor — Supply Chain Assurance for the mid-market — was built around exactly the five artefacts above. That is deliberate: we scoped the product against the same clause this page unpacks. Mapping:
| 21(2)(d) artefact | Vittnor feature |
|---|---|
| 01 — Supplier inventory | Suppliers recorded by type and by service, each put in or out of scope by a five-question scope check. |
| 02 — Risk classification | Twelve questions give each supplier in scope a tier (Low, Medium, High or Critical). The overall tier is the worst of six categories, never an average. |
| 03 — Per-supplier evidence | Requirements answered from your own records or from the supplier, with the questions asked alongside the answers received. |
| 04 — Decision trail | Review decisions — every approval and rejection recorded with who made it and when, in your organisation's audit log. |
| 05 — Reaction plan | Material changes — a new sub-processor, an expired certificate, an incident at the supplier — are flagged by the reviewer and prompt a re-review. Automated trigger firing ships in V1.2 (2027). |
We do not claim the product makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it. We claim the product gives you the evidence structure those judgements need.
Supplier assurance is becoming table stakes.
Not only because regulators say so — because customers ask. Companies with a defensible programme answer faster and are easier to buy from.
That is the operational shift Article 21(2)(d) is quietly forcing. The directive uses one sentence. The implementation takes years.
Where this leads, depending on where you are.
NIS2 readiness check
Twenty questions. Score, gap report, an honest steer on where you stand against the five artefacts.
Take the checkSupplier Exposure Assessment
A practitioner walks your supplier portfolio against this clause and hands back a written exposure report. €3,900 one-off.
See the engagementVittnor
Vittnor keeps your supplier scope, risk assessments, evidence and review decisions in one place, so the answer to an auditor is a lookup, not a quarterly fire drill.
See the productWorking through 21(2)(d) and want a second pair of eyes?
30 minutes. No prep needed. Bring whatever you are stuck on — supplier scoping, evidence collection, audit prep, regulator-readiness. Honest answers.