Step 2 of 4 · Assess

How much risk each supplier brings

For each supplier in scope, answer twelve questions, then set a tier: Low, Medium, High or Critical.

This step produces:

02A documented risk classification

Twelve questions in six areas

Answer for how you use the supplier today. In each area, the answers run from least to most risk, except "Not known yet" (questions 9 and 10), which means you still have to find out.

Availability: how much you rely on it

Ask the people who use it every day how long their workarounds would last. Question 2 is how long you could keep going, not how fast the supplier promises to recover.

1How much do your operations, or the services you provide, rely on it?
1. Not significantly
2. Low
3. Material
4. Full
2How long could you keep operating if it stopped?
1. More than a week
2. 1 to 7 days
3. Less than a day
4. Less than 4 hours

Confidentiality: what it can see

Answer for the most sensitive data it can reach, not only what it is meant to handle. Special categories of personal data are those in GDPR Article 9, such as health data.

3What is the most sensitive data it can see or hold?
1. None, or only public
2. Personal
3. Confidential business
4. Special categories of personal data
4Roughly how many records about people or customers does it hold for you?
1. None
2. Fewer than 1,000
3. 1,000 to 100,000
4. More than 100,000
5Which of your credentials, keys or secrets does it hold or manage?
1. None
2. End-user credentials only
3. Service credentials with limited scope
4. Admin credentials or encryption keys

Privileged access: what it can do in your systems

Check what its accounts can actually do. Persistent access stays open between jobs. An automatic update with admin rights runs before anyone on your side sees it, so it is the riskiest answer to question 8.

6What access does it have to your network?
1. None
2. Limited or scoped
3. Privileged or persistent
7What access does it have to your identity or cloud administration?
1. None
2. Limited, scoped permissions
3. Admin-level permissions
8Does it put software, devices, updates or changes into your systems?
1. No
2. Yes, you review and install them
3. Yes, it changes them itself
4. Yes, automatically and with admin rights

Supply chain: who stands behind it

The companies it relies on, such as its hosting provider, are part of the service you buy. Start from its sub-processor list, which you read in Step 3.

9Does it rely on other companies to deliver this service, and do you know who they are?
1. No
2. Yes, and we know who
3. Yes, but we know only some, or it won't say
4. Not known yet

Jurisdiction: where your data and support sit

Count where support and admin access come from, not only where data is stored. An EU adequacy decision is the European Commission's decision, under GDPR Article 45, that a country ensures an adequate level of protection for personal data; for the United States it covers only organisations certified under the EU–US Data Privacy Framework.

10Where is your data stored or processed, and where is support or admin access provided from?
1. Only the EU/EEA
2. Also countries with an EU adequacy decision
3. Also other countries
4. Not known yet

Resilience: how replaceable it is

Count the whole move: getting your data out, setting up the replacement and running both while you switch. A contract with no exit term (Step 3) can make it longer.

11How long would it take to replace it?
1. Less than 3 months
2. 3 to 12 months
3. 12 to 24 months
4. More than 24 months, or no way out
12Could another supplier take over?
1. We already use more than one
2. Yes
3. Only a few, or switching is hard
4. No realistic alternative

How to set the tier

The strongest single risk sets the tier, not an average. One serious answer, such as admin rights in your systems or full reliance on the service, is enough for High or Critical, and five good answers don't hide it.

An average would let one serious exposure disappear behind quieter answers. A payroll processor with good answers everywhere else still holds health data, and that one answer sets its tier. Write down what set each tier in one line, as the examples below do.

NIS2 asks for measures that are "appropriate and proportionate" (Directive (EU) 2022/2555, Article 21(1)). That is why the tier comes from your answers, not from the supplier's name or size.

Your tiers depend on your circumstances. The same supplier can be Low for one company and Critical for another, because the tier comes from your answers about your data, your access and how much you rely on it. What has to hold is consistency: the same answers give the same tier across your register, and every tier has its reason on record. A tier is your own risk rating, not a legal category: national law may define its own (see the country pages).

To stay consistent, keep a short note of which answers give which tier, starting from the examples below.

Not known yet is not a refusal

Use "not known yet" (questions 9 and 10) where you need to find out, rather than guessing. A supplier that refuses to say gives the riskier answer.

"Not known yet" is honest and temporary: give it an owner and a date, and revisit the tier when the answer arrives. The web analytics tool in the examples below has a tier while one answer is still open.

A refusal is an answer: the supplier has chosen not to tell you. Record the riskier option, such as "Yes, but we know only some, or it won't say" for question 9, or "Also other countries" for question 10.

Examples, not rules

Each shows how the answers led to a tier in one typical case. Yours can differ if your answers do. They describe kinds of supplier, never named companies: a tier rates your relationship with a supplier, not the supplier.

Tier examples: a kind of supplier, its tier, and what decided it
Supplier	Tier	What decided it
EU solo consultant: no data, no access	Low	Nothing above Low.
US training provider, certified under the EU–US Data Privacy Framework: no data	Medium	Where: data or support also in countries with an EU adequacy decision (for the US, that covers only certified companies).
Offshore helpdesk: no data, no access	Medium	Where: support is also given from other countries.
EU translation agency: confidential documents	Medium	Data: it handles confidential business data.
Web analytics tool: sub-suppliers not known yet	Medium	Supply chain: you don't know yet which companies it relies on.
Customer relationship management (CRM) service: EU, support from adequacy countries	Medium	Several moderate risks, no single strong one.
Endpoint detection and response (EDR) provider: kernel agent, automatic updates	High	Access: it puts updates into your systems automatically, with admin rights.
Managed service provider (MSP) running your firewalls: admin credentials, privileged access	High	Access: it holds admin credentials and has privileged access to your network.
Payroll processor: EU, health data	High	Data: special categories of personal data (health).
Cloud accounting service: invoicing depends on it	High	Reliance: you rely on it materially.
Remote monitoring and management (RMM) tool: pushes updates automatically	Critical	Access and reliance: automatic updates with admin rights, and you rely on it materially.
Managed security service provider (MSSP): admin over your tenant, support from several countries around the clock	Critical	Several strong risks: admin over your tenant, sensitive data, support from several countries.
Large cloud provider (hyperscaler) running core production	Critical	Reliance: your operations stop if it fails, and there is no realistic alternative.

Checklist

The twelve questions are answered for every supplier in scope, using "not known yet" (questions 9 and 10) where you need to find out, rather than guessing. A supplier that refuses to say gives the riskier answer.
Every supplier in scope has a tier, set by its strongest single risk, with what set it in one line.
Who set each tier, and when, is recorded.

Ticks aren't saved. The same checklist is in the PDF.

In the Excel file, carry on along the same row of the Steps 1-2 Register sheet.

End of Step 2 of 4

Next: Step 3Start with what you already hold

Read the contract first. Then check what is on file and what the supplier publishes. Ask the supplier only for what is still missing.

Previous: Step 1 — Which suppliers matter Back to the kit overview

Vittnor by Shards Cybersecurity · shardscybersecurity.io · version 1.2 · last reviewed 20 October 2026

Licence: CC BY 4.0. Free to use inside your organisation, and to show to your auditors and suppliers. If you publish it or hand it out as a template, keep the credit line and say what you changed.

This kit supports your Article 21(2)(d) work; it is not legal advice. It lists contract terms to look for, but doesn't judge whether a contract is adequate. No tool or template makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it.