A decision you can defend later
Three years from now, after staff turnover, the record still has to show who decided, on what evidence current at the time, with what conditions, and when you planned to look again.
This step produces:
- 04A defensible decision trail
- 05A reaction plan for material change
Record a decision for every supplier in scope
Each review ends with one decision per supplier in scope, for the current period. Write the reason in a sentence or two, from the evidence you relied on, so it still makes sense to someone who wasn't there.
| Decision | When it fits |
|---|---|
| Approved | The evidence covers what the tier needs. |
| Approved with risk | You accept a known gap, with conditions, an owner and a date. For a supplier the business depends on and can't drop, approving with conditions and a plan for how you would replace it is a defensible answer. |
| Rejected | The risk is too high, and there is a way out. |
A condition needs an owner and a date, or nobody follows it up. A contract term missing in Step 3 becomes a condition here, to be fixed at the renewal. Set the next review date as you decide: your policy says how often each tier is reviewed.
When a supplier can't be dropped
Rejected is a real option only when there is a way out. For a supplier the business can't do without, record Approved with risk instead: name the gap, the conditions that reduce it, such as tighter access on your side or the missing terms at renewal, and a plan for how you would replace it, drawing on your answers to questions 11 and 12 in Step 2. An honest record of a risk you carry is worth more later than a rejection nobody acted on.
Who may accept risk
Name it in your policy, tier by tier. For High and Critical, we suggest the management body: Article 20 of NIS2 has it approve the cybersecurity risk-management measures and oversee how they are carried out.
Settle it before you need it, so every Approved with risk carries the name of someone entitled to accept it.
When to look again early
Name the events that bring the next review forward. Each one is a reason to check whether the tier, the evidence or the contract still holds.
A security incident at the supplier
It tests what the evidence said. Check what the incident reached, and whether the supplier told you, and when.
An expired certificate or audit report
The evidence behind the decision is no longer current.
A new sub-supplier
Your answers to questions 9 and 10 may change.
A change of ownership
Who stands behind the service, and where it is run from, may change.
An EU-level risk assessment of a critical supply chain that covers what it provides (NIS2 Articles 21(3) and 22(1))
When you decide which supply chain measures are appropriate, NIS2 has you take the results of that assessment into account.
A contract renewal, or the end of the relationship
A renewal is the moment to add missing contract terms; an ending starts the steps below.
Give each trigger an owner, and a date by which the early review is done.
When a supplier leaves
A supplier that has left can still hold your information and still have accounts in your systems. Have the information returned or disposed of, and revoke the accounts. Then keep its records: a later question about an old decision needs the evidence it rested on.
- Its access is revoked.
- The retrieval and disposal of your information is confirmed, as the contract's exit term says.
- The end date is recorded, and its records are kept for the history.
National rules on top
NIS2 is a directive: each country's law sets the detail, and some add rules of their own. Before you settle who decides and how often you review, check your country on the country pages.
Checklist
Ticks aren't saved. The same checklist is in the PDF.
In the Excel file, use the Step 4 Decisions sheet.
You've finished the four steps
Last, write your supply chain security policy. One page that says how you run steps 1 to 4. Fill in the blanks, have your management body approve it, and set a date to review it. Build it online and download it as a Word file, or use page 6 of the PDF.
Keeping this current across many suppliers? Vittnor — Supply Chain Assurance for the mid-market — keeps the register, the evidence and every decision in one place, and records who decided what, when and why. The pilot is open now, and pilot members help shape the first release. A Free plan for up to 5 suppliers opens soon. Join the pilot
Vittnor by Shards Cybersecurity · shardscybersecurity.io · version 1.2 · last reviewed 20 October 2026
Licence: CC BY 4.0. Free to use inside your organisation, and to show to your auditors and suppliers. If you publish it or hand it out as a template, keep the credit line and say what you changed.
This kit supports your Article 21(2)(d) work; it is not legal advice. It lists contract terms to look for, but doesn't judge whether a contract is adequate. No tool or template makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it.