Skip to main content
The pilot is open — free for the first cohort. V1 lists on the Microsoft Marketplace Q4 2026.→ Apply
SHARDSCybersecurityVittnor · NIS2
NIS2 · Article 21(2)(d) · Free contract check

Check one supplier contract, term by term

Leave with a record of one contract's gaps, ready for the renewal. Read the contract against the eight terms of Implementing Regulation (EU) 2024/2690, Annex point 5.1.4, and see which apply to you and why.

  1. 1Pick where you are regulated

    Choose your countries and answer one question about your organisation.

  2. 2Read the contract term by term

    Each term has a plain question, what good looks like and words to search for.

  3. 3Keep the record

    Each gap gets a decision: fix at renewal, or accept with a reason.

Free · No sign-up · Nothing leaves your browser · CC BY 4.0

Part of the NIS2 supplier review kit, Step 3: Collect evidence.

Regulated in

The EU terms are always shown. Add the countries whose national rules apply to you.

Is your organisation one of the provider types Implementing Regulation (EU) 2024/2690 names?

Article 1 of the regulation names these:

  • DNS service providers (domain name system)
  • TLD name registries (top-level domain)
  • cloud computing service providers
  • data centre service providers
  • content delivery network providers
  • managed service providers
  • managed security service providers
  • providers of online market places
  • providers of online search engines
  • providers of social networking services platforms
  • trust service providers

Your answer sets whether each EU term reads as required or as good practice.

The contract, marked up

Your contract

EU · Implementing Regulation (EU) 2024/2690, Annex point 5.1.4

Your marks stay in this browser tab. Checked against: EU 2026-10 (checked 20 October 2026)

GR-6 · Annex point 5.1.4(a)

Not yet known

Answer the provider-type question above: it sets whether each term is required or good practice for you. With Austria selected, the terms are required.

Does the contract set out the cybersecurity requirements the supplier must meet?

What good looks like
Named measures, a security schedule or a standard the supplier has to meet, covering the services or products you buy from it.
Search the contract for
  • security requirements
  • information security
  • technical and organisational measures
  • security schedule
  • ISO 27001

Partly: the contract covers only part of what the term asks. Not applicable: the term doesn't fit this service.

Contract check record

Tier

Your tier from Step 2 of the kit. It changes nothing about which terms apply.

Checked against
EU 2026-10 (checked 20 October 2026)

0 of 8 terms answered

  • 0 Yes
  • 0 Partly
  • 0 No
  • 0 Not applicable

Gaps and decisions

A Partly or a No is a gap, and so is a Slovak process item marked Not yet. Choose a decision for each gap.

No gaps marked so far.

For the kit's Excel file, template 1.0

The row it copies: 14 columns, in the Excel file's order

Paste it into the first empty row of the sheet Step 3 Contract check.

The Word file holds the record as a table, with your own entries, a section for each country and the date each set of rules was checked.

Done with this contract? "Check another contract" keeps your countries and provider type and clears the rest.

Questions

Is this legal advice?

No. The check lists the contract terms to look for and gives no verdict on a contract. Compliance is the entity's responsibility, and the competent authority and your auditors judge it.

Do I need all eight terms in every contract?

Not necessarily. Annex point 5.1.4 asks for the terms "where appropriate". For the entities the regulation binds, Article 2(2) has you write down your reasoning in a comprehensible way when you consider a term not appropriate, not applicable or not feasible; the check has a reason field for that.

What if the supplier refuses a term?

Mark it as a gap and choose a decision. You can fix it at renewal, which carries the term into your renewal decision (Step 4 of the kit), or accept the gap with a reason, an owner and a date.

What about contracts signed before NIS2 applied?

Check them the same way. Where a current contract lacks a term, plan to add it at the next renewal: note the renewal date and record the fix as a condition. National law can treat older contracts differently; if Slovakia is selected, its notes quote the decree's rule for contracts concluded by 31 August 2025.

Can I use the record for my auditor?

The record shows what you checked, what the contract says, and what you decided and why, so you can show it. Whether it is enough is for the competent authority and your auditors to judge.

The contract check in full

Every term, question and national rule of the check, printed so you can read it without the tool. It follows Article 21(2)(d) of NIS2 (Directive (EU) 2022/2555) and Annex point 5.1.4 of Implementing Regulation (EU) 2024/2690.

Required, or good practice?

Your answers to the two setup questions set how each EU term reads. The rules are:

Show how each term reads: required or good practice
Required
On your answers, Regulation 2024/2690 binds you as one of the provider types it names. Each term applies where appropriate; where you consider a term not appropriate, you record your reasoning (Article 2(2)).
On your answers, Austria's NISV 2026 ordinance § 2 applies these terms to you, where appropriate. Where you consider a term not appropriate, you record your reasoning (Article 2(2) of the regulation).
On your answers, Regulation 2024/2690 binds you as one of the provider types it names, in Austria as elsewhere. Austria's NISV 2026 § 2 extends the same terms to the entity types the regulation does not name, so the answer is the same either way. Each term applies where appropriate; where you consider a term not appropriate, you record your reasoning (Article 2(2)).
Good practice
On your answers, these terms are good practice for you (NIS2 Recital 85). They still matter: Article 21(2)(d) of NIS2 has essential and important entities take measures for "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers", and these eight terms are the EU's own list of what a supplier contract can cover. A national layer can still require them.
Not yet known
Answer the provider-type question above: it sets whether each term is required or good practice for you. With Austria selected, the terms are required.

The eight EU terms

Each term applies where appropriate. Where you consider a term not appropriate, not applicable or not feasible for a contract, you write down your reasoning in a comprehensible way (Article 2(2) of the regulation).

Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Article 2(2), second subparagraph · Checked on

Show the eight EU terms in full

  1. (a)Security requirements for the supplier

    Does the contract set out the cybersecurity requirements the supplier must meet?

    What good looks like
    Named measures, a security schedule or a standard the supplier has to meet, covering the services or products you buy from it.
    Search the contract for
    • security requirements
    • information security
    • technical and organisational measures
    • security schedule
    • ISO 27001

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(a) · Checked on

  2. (b)Supplier staff: awareness, skills, training, certifications

    Does it require the supplier's staff to have the awareness, skills and training the work needs, and certifications where appropriate?

    What good looks like
    Training or qualification duties for the people who work on your service, and certifications where the work calls for them.
    Search the contract for
    • training
    • awareness
    • qualified
    • certification
    • personnel
    • competence

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(b) · Checked on

  3. (c)Background checks on the supplier's staff

    Does it set requirements for verifying the background of the supplier's staff?

    What good looks like
    Checks on the people who work on your service, as far as the law allows.
    Search the contract for
    • background check
    • screening
    • vetting
    • personnel security
    • verification

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(c) · Checked on

  4. (d)Incident notification without undue delay

    Must the supplier notify you, without undue delay, of incidents that present a risk to the security of your network and information systems?

    What good looks like
    A duty to notify you, a contact route, and what the notice has to contain.
    Search the contract for
    • notify
    • incident
    • without undue delay
    • security breach
    • hours
    • notification

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(d) · Checked on

  5. (e)The right to audit, or to receive audit reports

    Do you have the right to audit the supplier, or the right to receive its audit reports?

    What good looks like
    Either one: an audit right, or the right to receive reports such as an independent assurance report (a SOC 2 report, for example) or the audit report behind an ISO 27001 certificate.
    Search the contract for
    • audit
    • inspect
    • audit report
    • SOC 2
    • certificate
    • assurance report

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(e) · Checked on

  6. (f)Vulnerability handling by the supplier

    Must the supplier handle vulnerabilities that present a risk to the security of your network and information systems?

    What good looks like
    A duty to fix or mitigate such vulnerabilities, with a route to tell you about them.
    Search the contract for
    • vulnerability
    • vulnerabilities
    • patch
    • remediate
    • security update
    • fix

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(f) · Checked on

  7. (g)Subcontracting rules and subcontractor security duties

    Does it set requirements for subcontracting and, where you allow subcontracting, pass your cybersecurity requirements on to subcontractors?

    What good looks like
    Notice or consent before new subcontractors, and the requirements of term (a) passed down to them.
    Search the contract for
    • subcontract
    • subcontractor
    • sub-processor
    • third party
    • flow down
    • consent

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(g) · Checked on

  8. (h)Exit duties, such as retrieval and disposal of your information

    Does it set what the supplier has to do when the contract ends, such as retrieval and disposal of your information?

    What good looks like
    Return in a usable form, then deletion, confirmed in writing.
    Search the contract for
    • termination
    • exit
    • return
    • deletion
    • destroy
    • retrieval
    • disposal

    Source: Implementing Regulation (EU) 2024/2690 (opens in a new tab), Annex point 5.1.4(h) · Checked on

National rules

Quoted from the law in its original language, each with our translation. A country with no items of its own shows what its law says.

Slovakia

Applies to: You are registered in Slovakia as an operator of an essential service (prevádzkovateľ základnej služby). The duty covers each third party whose work is directly tied to running your networks and information systems.

Show Slovakia's rules in full
The first question for Slovakia

Is this supplier a third party under § 19(2) of Act 69/2018? That means its work for you is directly tied to the availability, confidentiality and integrity of running your networks and information systems.

Answer for this supplier and this contract. The Slovak items open only if § 19(2) applies.

  • Yes. Its work is directly tied to running our networks and information systems, and no exception applies.
  • No. An exception in § 19(3) applies: the supplier is itself an operator of an essential service, or the risk of its work is low.
  • No. Its work is not directly tied to running our networks and information systems.

Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 19(2), first sentence · Checked on

Original (Slovak)

Prevádzkovateľ základnej služby je povinný pri výkone činnosti, ktorá priamo súvisí s dostupnosťou, dôvernosťou a integritou prevádzky sietí a informačných systémov prevádzkovateľa základnej služby prostredníctvom tretej strany, uzatvoriť zmluvu o zabezpečení plnenia bezpečnostných opatrení a notifikačných povinností podľa tohto zákona počas celej doby výkonu tejto činnosti; pri uzatvorení zmluvy sa vykonáva analýza rizík.

Our translation

Where an activity directly related to the availability, confidentiality and integrity of the operation of the networks and information systems of the operator of an essential service is performed through a third party, the operator is obliged to conclude a contract on ensuring performance of security measures and notification duties under this Act for the whole period of the activity; a risk analysis is carried out when the contract is concluded.

Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 19(3) · Checked on

Original (Slovak)

Povinnosť uzatvoriť zmluvu podľa odseku 2 neplatí, ak je tretia strana prevádzkovateľom základnej služby, alebo ak je riziko vo vzťahu k činnosti, ktorá priamo súvisí s dostupnosťou, dôvernosťou a integritou prevádzky sietí a informačných systémov prevádzkovateľa základnej služby prostredníctvom tretej strany nízke.

Our translation

The duty to conclude a contract under paragraph 2 does not apply if the third party is itself an operator of an essential service, or if the risk in relation to the activity directly related to the availability, confidentiality and integrity of the operation of the networks and information systems of the operator of an essential service, performed through a third party, is low.

Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 5(1)(ad) (definition) · Checked on

Original (Slovak)

dodávateľa na výkon činností, ktoré priamo súvisia s prevádzkou sietí a informačných systémov pre prevádzkovateľa základnej služby (ďalej len „tretia strana“)

Our translation

the supplier of activities directly related to the operation of networks and information systems for the operator of an essential service (hereinafter the "third party")

  1. SK-1Commitment to your security policies

    Relates to EU term (a)

    Does the contract commit the supplier to comply with your security policies?

    What good looks like
    A clause binding the supplier to the security policies you name, for as long as the work lasts.
    Search the contract for
    • security policies
    • comply
    • policy
    • commitment
    • compliance with policies
    • bezpečnostné politiky
    • dodržiavať
    • záväzok
    • politiky prevádzkovateľa

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), § 7(2)(a) · Checked on

    Original (Slovak)

    Zmluva podľa § 19 ods. 2 zákona obsahuje najmä a) záväzok dodávateľa na výkon činnosti, ktorá priamo súvisí s dostupnosťou, dôvernosťou a integritou prevádzky sietí a informačných systémov prevádzkovateľa základnej služby (ďalej len „tretia strana“) dodržiavať bezpečnostné politiky prevádzkovateľa základnej služby,

    Our translation

    A contract under § 19(2) of the Act contains in particular (a) the commitment of the supplier of the activity directly related to the availability, confidentiality and integrity of the operation of the networks and information systems of the operator of an essential service (hereinafter the "third party") to comply with the security policies of the operator of an essential service,

  2. SK-2The supplier's consent to those policies

    Relates to EU term (a)

    Does the contract record the supplier's consent to those security policies?

    What good looks like
    An express statement of consent to the policies, next to the commitment in SK-1.
    Search the contract for
    • consent
    • agrees
    • acknowledges
    • security policies
    • súhlas
    • vyjadrenie súhlasu
    • bezpečnostné politiky

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), § 7(2)(b) · Checked on

    Original (Slovak)

    […] b) vyjadrenie súhlasu tretej strany s uvedenými bezpečnostnými politikami,

    Our translation

    […] (b) the expression of consent of the third party to those security policies,

  3. SK-3Your checks and audit at the supplier

    Relates to EU term (e)

    Does the contract set out the scope and manner of your checks and audit at the supplier, and that you can carry them out?

    What good looks like
    A clause on how far your checks and audit reach at the supplier, how they run, and that you can carry them out.
    Search the contract for
    • audit
    • check
    • inspection
    • control
    • on site
    • scope and manner
    • kontrola
    • kontrolné činnosti
    • audit
    • rozsah
    • spôsob
    • u tretej strany

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), § 7(2)(c) · Checked on

    Original (Slovak)

    ustanovenie o rozsahu, spôsobe a možnosti vykonávania kontrolných činností a auditu prevádzkovateľom základnej služby u tretej strany,

    Our translation

    a provision on the scope, manner and possibility of carrying out checks and audit by the operator of an essential service at the third party,

  4. SK-4Duty to inform you of incidents and other facts, and to cooperate

    Relates to EU term (d)

    Must the supplier inform you of cybersecurity incidents and of other facts that affect cybersecurity, and cooperate in resolving them?

    What good looks like
    A duty to inform you of incidents and of other facts that affect cybersecurity, and to help resolve them.
    Search the contract for
    • inform
    • incident
    • cooperation
    • facts affecting cybersecurity
    • notify
    • informovať
    • kybernetický bezpečnostný incident
    • súčinnosť
    • bezodkladne
    • skutočnosti

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), § 7(2)(d) · Checked on

    Original (Slovak)

    ustanovenie o povinnosti informovať prevádzkovateľa základnej služby o kybernetickom bezpečnostnom incidente a o skutočnostiach majúcich vplyv na zabezpečovanie kybernetickej bezpečnosti a poskytnúť súčinnosť pri jeho riešení.

    Our translation

    a provision on the duty to inform the operator of an essential service about a cybersecurity incident and about facts having an impact on ensuring cybersecurity, and to provide cooperation in resolving it.

  5. SK-5Technology-specific security requirements

    Relates to EU term (a)

    Does the contract include security requirements specific to information and communications technology or to operational technology?

    What good looks like
    Security requirements written for the technology involved, in the contract itself or in a schedule that forms part of it.
    Search the contract for
    • technology-specific
    • ICT security
    • operational technology
    • security requirements
    • schedule
    • informačné a komunikačné technológie
    • operačné technológie
    • bezpečnostné požiadavky
    • špecifické

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), Annex 1, item 148 · Checked on

    Original (Slovak)

    súčasťou zmluvy podľa § 19 ods. 2 zákona sú bezpečnostné požiadavky špecifické pre informačné a komunikačné technológie alebo operačné technológie

    Our translation

    security requirements specific to information and communication technologies or operational technologies are part of a contract under § 19(2) of the Act

  6. SK-6Risk analysis when the contract is concluded

    Was a risk analysis of this supplier's services carried out when the contract was concluded?

    What good looks like
    A record of a risk analysis of the supplier's services, done when the contract was concluded.
    Search the contract for
    • risk analysis
    • risk assessment
    • supplier risk
    • supplier services
    • analýza rizík
    • dodávateľské služby
    • dodávateľské činnosti

    Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 19(2), first sentence, last clause · Checked on

    Original (Slovak)

    pri uzatvorení zmluvy sa vykonáva analýza rizík.

    Our translation

    a risk analysis is carried out when the contract is concluded.

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), Annex 1, item 147 · Checked on

    Original (Slovak)

    uzatvoreniu zmluvy podľa § 19 ods. 2 zákona predchádza analýza rizík dodávateľských služieb alebo iných dodávateľských činností

    Our translation

    the conclusion of a contract under § 19(2) of the Act is preceded by a risk analysis of supply services or other supply activities

  • If you operate a critical essential service, you also report the conclusion and the end of a contract with a third party that has significant influence to Slovakia's National Security Authority (NBÚ).

    Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 19(7) · Checked on

    Original (Slovak)

    […] ak prevádzkovateľ základnej služby prevádzkuje kritickú základnú službu, je povinný hlásiť úradu aj informáciu o uzatvorení zmluvy s treťou stranou o zabezpečení plnenia bezpečnostných opatrení a notifikačných povinností, ktorá má významný vplyv pri zabezpečovaní kybernetickej bezpečnosti a aj informáciu o jej ukončení.

    Our translation

    […] if the operator of an essential service operates a critical essential service, it is obliged to report to the Authority also the information on the conclusion of a contract with a third party on ensuring performance of security measures and notification duties, which has significant influence in ensuring cybersecurity, and also the information on its termination.

  • A contract under § 19(2) concluded up to 31 August 2025 runs to its originally agreed end at most. After 31 August 2025 it cannot be extended if it is not in line with the security measures of §§ 3 to 7 of the decree.

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), § 8 · Checked on

    Original (Slovak)

    Zmluva podľa § 19 ods. 2 zákona uzatvorená do 31. augusta 2025 ostáva v platnosti najneskôr do doby pôvodne v nej dohodnutej; túto dobu nemožno po 31. auguste 2025 predĺžiť, ak už uzatvorená zmluva nie je v súlade s bezpečnostnými opatreniami podľa § 3 až 7. Týmto ustanovením nie je dotknutý § 34b ods. 5 zákona.

    Our translation

    A contract under § 19(2) of the Act concluded by 31 August 2025 remains in force at the latest until the time originally agreed in it; that time cannot be extended after 31 August 2025 if the contract already concluded is not in line with the security measures under §§ 3 to 7. This provision does not affect § 34b(5) of the Act.

  • Operators that were operators of an essential service under the Act as in force up to 31 December 2024 (the Act treats them as operators of a critical essential service, § 34b(1)) may, until 31 December 2026, also apply the earlier rules (§ 34b(5)). NBÚ's guidance, which does not bind, reads this as including the longer contract list of the repealed Decree 362/2018 § 9(2), which also covers subcontracting and exit.

    Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 34b(1) · Checked on

    Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 34b(5) · Checked on

    Original (Slovak)

    Prevádzkovateľ základnej služby podľa odseku 1 môže do 31. decembra 2026 prijímať a realizovať bezpečnostné opatrenia podľa predpisov účinných od 1. januára 2025 aj prijímaním a realizovaním bezpečnostných opatrení podľa predpisov účinných do 31. decembra 2024.

    Our translation

    An operator of an essential service under paragraph 1 may, until 31 December 2026, adopt and carry out security measures under the rules effective from 1 January 2025 also by adopting and carrying out security measures under the rules effective up to 31 December 2024.

    Source: NBÚ (opens in a new tab), "Tretia strana a notifikačné povinnosti", 30 March 2026 (non-binding guidance) · Checked on

    Original (Slovak)

    V § 7 ods. 2 vyhlášky č. 227/2025 Z. z. (prípadne ak sa aplikuje prechodné ustanovenie § 34b ods. 5 zákona č. 69/2018 Z. z. ide o § 9 ods. 2 vyhlášky č. 362/2018 Z. z.) sú uvedené minimálne povinné obsahové náležitosti zmluvy podľa § 19 ods. 2 zákona č. 69/2018 Z. z.

    Our translation

    In § 7(2) of Decree No. 227/2025 Coll. (or, where the transitional provision of § 34b(5) of Act No. 69/2018 Coll. is applied, § 9(2) of Decree No. 362/2018 Coll.) the minimum mandatory content of a contract under § 19(2) of Act No. 69/2018 Coll. is set out.

  • When your organisation is one of the provider types the regulation names:

    On your answers, you are one of the provider types Regulation 2024/2690 names. Act § 19(1) sends the provider types listed in its § 2(2) to the regulation for their own security measures. Whether the contract duty in § 19(2) and Decree § 7(2) also binds them is not settled in the text.

    Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 19(1), last sentence · Checked on

    Original (Slovak)

    Osoba poskytujúca niektorú zo služieb alebo vykonávajúcu niektorú z činností podľa § 2 ods. 2 plní bezpečnostné opatrenia podľa osobitného predpisu.

    Our translation

    A person providing any of the services or carrying out any of the activities under § 2(2) fulfils the security measures under a special regulation.

  • Annex 1 of the decree phrases one measure, item 146, as a contract with each third party "with significant influence" (s významným vplyvom). Act § 19(2) does not use those words, and the text does not reconcile the two. The gate above follows the Act.

    Source: Decree 227/2025 Coll. on security measures (opens in a new tab), Annex 1, item 146 · Checked on

    Original (Slovak)

    na riadenie informačnej bezpečnosti a kybernetickej bezpečnosti vo vzťahoch s tretími stranami je s každou treťou stranou s významným vplyvom uzatvorená zmluva podľa § 19 ods. 2 zákona

    Our translation

    for the management of information security and cybersecurity in relations with third parties, a contract under § 19(2) of the Act is concluded with each third party with significant influence

  • NBÚ publishes a model contract for § 19(2) on its page on security measures. It is guidance and not binding.

    Source: NBÚ (opens in a new tab), page "Bezpečnostné opatrenia" (updated 8 July 2026) · Checked on

Czechia

Applies to: Providers of a regulated service, in both regimes (higher and lower obligations), where a security measure is carried out through a supplier.

Show Czechia's note in full

  • Czech law requires a provider of a regulated service to include the requirements of a security measure in its contracts with suppliers, where the measure is carried out through them (Act 264/2025 § 13(5)). The contract provisions are listed in Annex 5 of Decree 409/2025 (higher-obligations regime) and in Annex 2 of Decree 410/2025 (lower-obligations regime).

    Source: Act 264/2025 Coll. on Cybersecurity (opens in a new tab), § 13(5) · Checked on

    Original (Czech)

    V případě, že poskytovatel regulované služby zavádí nebo provádí bezpečnostní opatření prostřednictvím dodavatele, je povinen vybírat svého dodavatele v souladu s požadavky vyplývajícími z bezpečnostního opatření a zahrnovat požadavky vyplývající z bezpečnostního opatření do smluv s dodavatelem.

    Our translation

    Where a provider of a regulated service introduces or carries out a security measure through a supplier, it is obliged to select its supplier in line with the requirements arising from the security measure and to include the requirements arising from the security measure in contracts with the supplier.

    Source: Decree 409/2025 Coll. (opens in a new tab), Annex 5 (higher-obligations regime) · Checked on

    Source: Decree 410/2025 Coll. (opens in a new tab), Annex 2 (lower-obligations regime) · Checked on

Austria

Applies to: Essential and important entities of the types listed in Annexes 1 and 2 of NISG 2026 that Regulation 2024/2690 does not name.

Show Austria's rules in full

  • Since 2 October 2026, NISV 2026 § 2 applies Article 2 and the whole Annex of Regulation 2024/2690, including the eight contract terms of point 5.1.4, to the essential and important entity types that the regulation does not name. The terms read as in the EU text, "where appropriate" included.

    Source: NISV 2026, BGBl. II Nr. 290/2026 (opens in a new tab), § 2 · Checked on

    Original (German)

    Die näheren Anforderungen an die Risikomanagementmaßnahmen gemäß Art. 2 samt Anhang der Durchführungsverordnung (EU) 2024/2690 […] ABl. Nr. L 2024/2690 vom 18.10.2024, sind auch auf die nicht von dieser Durchführungsverordnung umfassten in den Anlagen 1 und 2 des Netz- und Informationssystemsicherheitsgesetzes 2026 (NISG 2026), BGBl. I Nr. 94/2025, gelisteten Arten wesentlicher und wichtiger Einrichtungen anwendbar.

    Our translation

    The detailed requirements for the risk-management measures under Art. 2, together with the Annex, of Implementing Regulation (EU) 2024/2690 […] (OJ L, 2024/2690, 18.10.2024) also apply to the types of essential and important entities, listed in Annexes 1 and 2 of the Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), BGBl. I Nr. 94/2025, that are not covered by this Implementing Regulation.

  • Where you consider a term not appropriate, not applicable or not feasible for a contract, Article 2(2) of the regulation has you document your reasoning in a comprehensible manner. Austria adds that no compensating measure is owed for requirements that apply only where appropriate, applicable or feasible (NISV 2026 § 4(4)).

    Source: NISV 2026, BGBl. II Nr. 290/2026 (opens in a new tab), § 4(4) · Checked on

    Original (German)

    Die Pflicht zur Umsetzung kompensierender Maßnahmen besteht nicht bezüglich jener Anforderungen gemäß § 2, denen ausdrücklich nur soweit angemessen, anwendbar oder durchführbar zu entsprechen ist.

    Our translation

    There is no duty to implement compensating measures for those requirements under § 2 that are expressly to be met only as far as appropriate, applicable or feasible.

  • The Bundesamt für Cybersicherheit, Austria's competent authority, says in its FAQ that a blanket reference to NISG 2026 in your terms and conditions or purchasing terms is not enough: the requirements aim at concrete, verifiable contract duties. This is the authority's reading and does not bind a court or the authority itself.

    Source: Bundesamt für Cybersicherheit (opens in a new tab), FAQ "Lieferkette" (updated 25 September 2026) · Checked on

    Original (German)

    Die regulatorischen Anforderungen zielen auf konkret ausgestaltete, überprüfbare Vertragspflichten ab – ein pauschaler Hinweis z. B. in den AGB oder in Einkaufsbedingungen auf das NISG 2026 genügt diesen Anforderungen nicht.

    Our translation

    The regulatory requirements aim at specifically drafted, verifiable contract duties – a blanket reference, for example in the general terms and conditions or in purchasing terms, to NISG 2026 does not meet these requirements.

  • The same FAQ says not every supplier is covered, but that IT providers alone would be too narrow: everyone in the supply chain of the network and information systems that support your services counts, for example the air conditioning for the server room.

    Source: Bundesamt für Cybersicherheit (opens in a new tab), FAQ "Lieferkette" (updated 25 September 2026) · Checked on

    Original (German)

    Im Rahmen des NISG 2026 sind nicht grundsätzlich alle Lieferanten erfasst. Andrerseits wäre eine Einschränkung auf IT-Dienstleister auch zu eng. […] Zu erfassen sind alle Teilnehmer der Lieferkette bezüglich der Netz- und Informationssysteme, welche die die Dienste der Einrichtung unterstützen bzw. ermöglichen. Dies würde z. B. auch die Klimaanlagentechnik für den Serverraum betreffen.

    Our translation

    In general, not all suppliers are covered under NISG 2026. On the other hand, a restriction to IT service providers would also be too narrow. […] All participants in the supply chain with regard to the network and information systems that support or enable the entity's services are to be covered. This would, for example, also concern the air-conditioning technology for the server room.

Germany

Applies to: Particularly important and important entities under BSIG § 28 (the BSIG's terms for NIS2's essential and important entities), including operators of critical facilities.

Show Germany's rules in full

  • BSIG § 30 sets no contract content of its own: § 30(2) names supply chain security as one of the measure areas, with no contract, clause or list.

    Source: BSIG (Gesetz über das Bundesamt für Sicherheit in der Informationstechnik und über die Sicherheit in der Informationstechnik von Einrichtungen), Article 1 of BGBl. 2025 I Nr. 301 (opens in a new tab), § 30(2) sentence 2 no. 4 · Checked on

    Original (German)

    Die Maßnahmen müssen zumindest Folgendes umfassen: […] 4. Sicherheit der Lieferkette einschließlich sicherheitsbezogener Aspekte der Beziehungen zu unmittelbaren Anbietern oder Diensteanbietern,

    Our translation

    The measures must cover at least the following: […] 4. security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers,

  • For the eleven provider types that Regulation 2024/2690 names, BSIG § 30(3) gives the regulation precedence, so the EU terms are required for them. For other entities, German law adds no contract terms of its own; the EU terms are then good practice (NIS2 Recital 85; see the EU terms above).

    Source: BSIG, Article 1 of BGBl. 2025 I Nr. 301 (opens in a new tab), § 30(3) · Checked on

    Original (German)

    Der von der Europäischen Kommission gemäß Artikel 21 Absatz 5 Unterabsatz 1 der NIS-2-Richtlinie erlassene Durchführungsrechtsakt zur Festlegung der technischen und methodischen Anforderungen an die in Absatz 1 genannten Maßnahmen in Bezug auf DNS-Diensteanbieter, Top Level Domain Name Registries, Cloud-Computing-Dienstleister, Anbieter von Rechenzentrumsdiensten, Betreiber von Content Delivery Networks, Managed Service Provider, Managed Security Service Provider, Anbieter von Online-Marktplätzen, Online-Suchmaschinen und Plattformen für Dienste sozialer Netzwerke und Vertrauensdiensteanbieter hat für die vorgenannten Einrichtungsarten Vorrang.

    Our translation

    The implementing act adopted by the European Commission under Article 21(5), first subparagraph, of Directive (EU) 2022/2555, laying down the technical and methodological requirements for the measures named in paragraph 1 with regard to DNS service providers, TLD name registries, cloud computing service providers, providers of data centre services, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers, takes precedence for the aforementioned types of entity.

  • The Federal Office for Information Security (BSI) says, about fully outsourced IT, that contracts alone are not enough: management stays responsible for steering and implementing risk management. It provides no contract templates, but an information package on the secure supply chain.

    Source: BSI (opens in a new tab), "Fragen und Antworten zu NIS-2" · Checked on

    Original (German)

    Verträge allein genügen nicht – die Geschäftsleitung bleibt in der Pflicht, das Risikomanagement zu steuern und umzusetzen.

    Our translation

    Contracts alone are not enough – management remains obliged to steer and implement risk management.

    Source: BSI (opens in a new tab), "Fragen und Antworten zu NIS-2" · Checked on

    Original (German)

    Nein, das BSI stellt zwar keine Vorlagen zur Verfügung, dafür jedoch das Infopaket Sichere Lieferkette.

    Our translation

    No, the BSI does not provide templates, but it does provide the information package Secure Supply Chain.

Terms used on this page

Show the terms used on this page
  • NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union.
  • NBÚ is Slovakia's Národný bezpečnostný úrad, the National Security Authority.
  • NISG 2026 is Austria's Netz- und Informationssystemsicherheitsgesetz 2026 (BGBl. I Nr. 94/2025).
  • NISV 2026 is Austria's Netz- und Informationssystemsicherheits-Verordnung 2026 (BGBl. II Nr. 290/2026).
  • BSIG is Germany's BSI Act, the Gesetz über das Bundesamt für Sicherheit in der Informationstechnik.
  • BSI is Germany's Bundesamt für Sicherheit in der Informationstechnik, the Federal Office for Information Security.

Keeping this current across many suppliers? Vittnor — Supply Chain Assurance for the mid-market — keeps the register, the evidence and every decision in one place, and records who decided what, when and why. The pilot is open now, and pilot members help shape the first release. A Free plan for up to 5 suppliers opens soon.

Join the pilot

Tell us what's missing

If a term or a national rule you need is missing, tell us. Every country's rules show the date they were checked.

Write to us

Vittnor by Shards Cybersecurity · shardscybersecurity.io · version 1.2 · last reviewed 20 October 2026

Licence: CC BY 4.0. Free to use inside your organisation, and to show to your auditors and suppliers. If you publish it or hand it out as a template, keep the credit line and say what you changed.

This kit supports your Article 21(2)(d) work; it is not legal advice. It lists contract terms to look for, but doesn't judge whether a contract is adequate. No tool or template makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it.