NIS2 supplier review kit
Four steps to a supplier register you can defend: which suppliers matter, how much risk each one brings, what evidence you hold, and what you decided. One checklist per step, a one-page policy to fill in, and an Excel file for the register itself.
Free · No email needed · CC BY 4.0 · Version 1.2, 20 October 2026 · New versions are announced on LinkedIn (opens in a new tab)
Read the four steps onlineHow it works
The kit is four steps for reviewing your suppliers under NIS2. Work through them in order: each one has a guide on this site and a checklist in the PDF, and the Excel file is where you record your answers. Each card pairs a step with the evidence it leaves you with. Together the four steps produce what, in our judgement, an auditor asks to see under Article 21(2)(d): the five evidence artefacts.
- Step 1 · Scope
Which suppliers matter
List every supplier, answer five questions for each, and keep a reason for any you leave out of scope.
Evidence for your auditor:
- 01A maintained supplier inventory tagged by service and data
- Step 2 · Assess
How much risk each supplier brings
Answer twelve questions for each supplier in scope, then set its tier: Low, Medium, High or Critical.
Evidence for your auditor:
- 02A documented risk classification
- Step 3 · Collect evidence
Start with what you already hold
Read the contract against eight terms, check what you already hold, and ask the supplier only for what is missing.
Evidence for your auditor:
- 03Per-supplier assessment evidence on a known cadence
- Step 4 · Decide
A decision you can defend later
Record a decision for each supplier in scope, with the reason, any conditions and the next review date.
Evidence for your auditor:
- 04A defensible decision trail
- 05A reaction plan for material change
What's in the download
The PDF
7 A4 pages
- Page 1Overview, and a self-check against the five artefacts
- Pages 2–5A checklist for each of the four steps
- Page 6Your supply chain security policy, to fill in
- Page 7About this kit: licence, versions and sources
Pages 2 to 6 carry no logo but yours: print them, fill them in, and keep them with your own records. Our name is on the cover and the last page only.
Download the PDFThe policy builder
Your policy, filled in
Answer four short steps and download your supply chain security policy as a Word file, ready for your own letterhead. It runs in your browser: nothing leaves it.
Build your policyThe Excel file
Your supplier register, steps 1 to 4
The kit's supplier register as an Excel file: scope and risk on one sheet, then the contract check, the evidence and your decisions, with dropdowns for the answers and an example row. No macros, no formulas in any cell, nothing hidden.
Download the Excel fileNo email needed.
Who it's for, and what it covers
The kit is written for the buyer: whoever in a company that falls under NIS2 has to answer for its suppliers, whether as IT manager, chief information security officer (CISO), compliance lead or owner.
At EU level, it covers the five artefacts, a supply chain security policy, and the eight contract terms set out in Implementing Regulation (EU) 2024/2690 (binding only for the provider types it names, and there each term applies "where appropriate"; a useful reference for everyone else). It leaves three things to others:
- National rules on top of the EU texts. Your country's law can add to them: start from the country pages. Austria's NISV 2026, for example, has applied the regulation's risk-management requirements, the eight contract terms included, to every essential and important entity since 2 October 2026. For a Czech entity in the higher-obligation regime, a more detailed national decree applies on top. The kit is the base, not the whole job.
- The supplier side. A supplier getting ready for its customers' questions can start with the supplier readiness check.
- Judging a contract. The kit lists the contract terms to look for. Whether a contract is adequate is for you and your lawyer to judge.
New suppliers too
Run the same four steps before you sign a new supplier, while the contract is still open for discussion.
Keeping this current across many suppliers? Vittnor — Supply Chain Assurance for the mid-market — keeps the register, the evidence and every decision in one place, and records who decided what, when and why. The pilot is open now, and pilot members help shape the first release. A Free plan for up to 5 suppliers opens soon.
Join the pilotPrefer it done with you? In the NIS2 Supplier Exposure Assessment, a practitioner works through your suppliers against Article 21(2)(d) and hands you back a written exposure report.
Tell us what's missing
If a step doesn't fit how your team works, or something you need isn't covered, tell us. When the kit changes, its version goes up and the change is listed with its date.
Write to usVersion history
- Version 1.2Added the policy builder: the policy, filled in for your organisation from four short steps, as a Word file. It replaces the Word file of versions 1.0 and 1.1.
- Version 1.1Added the supplier register as an Excel file.
- Version 1.0First published.
Vittnor by Shards Cybersecurity · shardscybersecurity.io · version 1.2 · last reviewed 20 October 2026
Licence: CC BY 4.0. Free to use inside your organisation, and to show to your auditors and suppliers. If you publish it or hand it out as a template, keep the credit line and say what you changed.
This kit supports your Article 21(2)(d) work; it is not legal advice. It lists contract terms to look for, but doesn't judge whether a contract is adequate. No tool or template makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it.