Skip to main content
The pilot is open — free for the first cohort. V1 lists on the Microsoft Marketplace Q4 2026.→ Apply
SHARDSCybersecurityVittnor · NIS2
NIS2 · Article 21(2)(d) · Free policy builder

Your supply chain security policy, filled in

Answer four short steps and get a short policy your management body can approve, filled in for your organisation, as a Word file for your own letterhead.

Free · No sign-up · Nothing leaves your browser · CC BY 4.0

Part of Step 4, Decide, of the NIS2 supplier review kit.

Your organisation

As it appears on your letterhead

Your role under NIS2

Choose supplier if you sell to regulated organisations but are not regulated yourself.

Who decides

The person who keeps this policy up to date

Article 20 of NIS2 has the management body approve the cybersecurity risk-management measures and oversee how they are carried out.

Review this policy every

Your tiers

For each tier, say what you check, who may accept the risk and how often you review. The four tiers are the ones Step 2 of the kit gives your suppliers.

Low

What you checkChoose all that apply

Review every

Medium

What you checkChoose all that apply

Review every

High

What you checkChoose all that apply

Review every

Critical

What you checkChoose all that apply

Review every

Wording and details

Wording

Optional. If you leave it empty, the sentence is left out.

19 blanks left

Show the policy
Back to the questions

Organisation

Supply chain security policy

Your logo
Policy details
OrganisationOrganisation
Policy ownerPolicy owner
Approved by (management body)Management body
Approved on
Next review of this policyReview interval
Version1.0
1Purpose

This policy sets how we manage the cybersecurity of our relationships with our direct suppliers and service providers (NIS2, Article 21(2)(d)).

2Our role in the supply chain

We are Role. We tell our direct suppliers about this role by How suppliers are told.

3Which suppliers are in scope

We keep a register of our direct suppliers and service providers, with a contact point for each and what it provides to us. A supplier is in scope when it can see more than public data, has any access to our systems, our operations depend on it, it supplies software, devices or updates that run in our systems, or a contract, a customer or a law requires an assessment. Every out-of-scope decision is recorded with a reason.

4Choosing new suppliers

Before signing, we look at the supplier's cybersecurity practices (including secure development), its ability to meet our security requirements, the overall quality and resilience of what it supplies (including the security measures built into it), and whether we can avoid depending on it alone. We also check: Other checks

5How we rate risk

Each supplier in scope gets a tier (Low, Medium, High or Critical) from twelve questions in six areas (availability, confidentiality, privileged access, supply chain, jurisdiction and resilience), with the answers kept in Where the answers are kept. The strongest single risk sets the tier, not an average. We rate each supplier by how we use it, and record the reason for every tier.

6What we check, who may accept risk, and how often we review, by tier
What we check, who may accept risk, and how often we review, by tier
TierWhat we checkWho may accept riskReview every
LowChecks, LowRisk accepted by, LowReview interval, Low
MediumChecks, MediumRisk accepted by, MediumReview interval, Medium
HighChecks, HighRisk accepted by, HighReview interval, High
CriticalChecks, CriticalRisk accepted by, CriticalReview interval, Critical
7When we review early

A security incident at the supplier, an expired certificate or audit report, a new sub-supplier, a change of ownership, an EU-level risk assessment of a critical supply chain that covers what it provides, a contract renewal, or the end of the relationship. Each trigger has an owner. Between reviews, we read suppliers' service level reports, where there are any, and look into incidents involving what they provide; we record whether either calls for an early review or a change to this policy.

8Contracts

New and renewed contracts cover the contract terms listed in Implementing Regulation (EU) 2024/2690, Annex point 5.1.4, where appropriate. Gaps in current contracts are fixed at renewal and tracked as conditions.

9When a supplier leaves

We revoke its access, confirm the retrieval and disposal of our information, and record the end date. Records are kept.

Sources: Directive (EU) 2022/2555, Articles 20, 21(2)(d), 21(3) and 22(1), Recital 85; Implementing Regulation (EU) 2024/2690, Annex points 5.1.1 to 5.1.7 and 5.2 (binding for the provider types it names and, through NISV 2026, for every essential and important entity in Austria; a useful reference for everyone else).

Template from the NIS2 supplier review kit v1.2 by Shards Cybersecurity (shardscybersecurity.io/nis2/supplier-review-kit), licensed CC BY 4.0. Using it inside your organisation needs no credit: delete this note when you adopt the policy.

19 blanks left

Blanks print as gaps to fill in by hand.

The policy in full

This is the plain wording with the kit's examples, as it prints. It follows Article 21(2)(d) of NIS2 (Directive (EU) 2022/2555) and the supply chain security points of Implementing Regulation (EU) 2024/2690.

One page that says how you run steps 1 to 4. Fill in the blanks, have your management body approve it, and set a date to review it.

Supply chain security policy

Organisation
Policy owner
Approved by (management body)
Approved on
Next review of this policy
Version

  1. 1 Purpose

    This policy sets how we manage the cybersecurity of our relationships with our direct suppliers and service providers (NIS2, Article 21(2)(d)).

  2. 2 Our role in the supply chain

    We are e.g. an important entity in energy, and a supplier to regulated customers. We tell our direct suppliers about this role by e.g. a clause in new contracts.

  3. 3 Which suppliers are in scope

    We keep a register of our direct suppliers and service providers, with a contact point for each and what it provides to us. A supplier is in scope when it can see more than public data, has any access to our systems, our operations depend on it, it supplies software, devices or updates that run in our systems, or a contract, a customer or a law requires an assessment. Every out-of-scope decision is recorded with a reason.

  4. 4 Choosing new suppliers

    Before signing, we look at the supplier's cybersecurity practices (including secure development), its ability to meet our security requirements, the overall quality and resilience of what it supplies (including the security measures built into it), and whether we can avoid depending on it alone. We also check:

  5. 5 How we rate risk

    Each supplier in scope gets a tier (Low, Medium, High or Critical) from twelve questions in six areas (availability, confidentiality, privileged access, supply chain, jurisdiction and resilience), with the answers kept in e.g. our supplier register. The strongest single risk sets the tier, not an average. We rate each supplier by how we use it, and record the reason for every tier.

  6. 6 What we check, who may accept risk, and how often we review, by tier

    TierWhat we checkWho may accept riskReview every
    Lowe.g. the contract terms
    Medium
    High
    Criticale.g. the contract terms, certificates, audit reports, a penetration test

  7. 7 When we review early

    A security incident at the supplier, an expired certificate or audit report, a new sub-supplier, a change of ownership, an EU-level risk assessment of a critical supply chain that covers what it provides, a contract renewal, or the end of the relationship. Each trigger has an owner. Between reviews, we read suppliers' service level reports, where there are any, and look into incidents involving what they provide; we record whether either calls for an early review or a change to this policy.

  8. 8 Contracts

    New and renewed contracts cover the contract terms listed in Implementing Regulation (EU) 2024/2690, Annex point 5.1.4, where appropriate. Gaps in current contracts are fixed at renewal and tracked as conditions.

  9. 9 When a supplier leaves

    We revoke its access, confirm the retrieval and disposal of our information, and record the end date. Records are kept.

Sources: Directive (EU) 2022/2555, Articles 20, 21(2)(d), 21(3) and 22(1), Recital 85; Implementing Regulation (EU) 2024/2690, Annex points 5.1.1 to 5.1.7 and 5.2 (binding for the provider types it names and, through NISV 2026, for every essential and important entity in Austria; a useful reference for everyone else).

Where your answers change the text

Your role, your country and the provider-type question change a few sentences. Everything else stays as above.

The formal wording says the same in the third person: it speaks of "the organisation" instead of "we" and "our".

Plain: "We check every new supplier before signing." Formal: "The organisation checks every new supplier before signing."

Clause 8, Contracts: three openings

A provider type the regulation names
New and renewed contracts cover the contract terms of Implementing Regulation (EU) 2024/2690, Annex point 5.1.4, where appropriate; the regulation binds us as one of the provider types it names. Where we consider a term not appropriate, not applicable or not feasible for a contract, we record our reasoning (Article 2(2)).
An entity regulated in Austria
New and renewed contracts cover the contract terms of Implementing Regulation (EU) 2024/2690, Annex point 5.1.4, where appropriate; NISV 2026 § 2 applies them to us as an essential or important entity. Where we consider a term not appropriate, not applicable or not feasible for a contract, we record our reasoning (Article 2(2) of the regulation).
Everyone else
New and renewed contracts cover the contract terms listed in Implementing Regulation (EU) 2024/2690, Annex point 5.1.4, where appropriate.

National sentences, for entities regulated in these countries

Slovakia

In Slovakia, every third party whose work is directly tied to running our networks and information systems has a contract with us on ensuring performance of security measures and notification duties, for as long as that work lasts, with at least the content of Decree 227/2025 § 7(2). We carry out a risk analysis when we conclude it; Act 69/2018 § 19(2) and (3) set the duty and its exceptions.

Source: Act 69/2018 Coll. on Cybersecurity (opens in a new tab), § 19(2), first sentence and § 19(3); Decree 227/2025 Coll. on security measures (opens in a new tab), § 7(2) · Checked on

Czechia

In Czechia, where we carry out a security measure through a supplier, we choose the supplier in line with the measure's requirements and include those requirements in our contract with it (Act 264/2025 § 13(5)).

Source: Act 264/2025 Coll. on Cybersecurity (opens in a new tab), § 13(5) · Checked on

Germany

German law sets no contract list of its own, so clause 8 adds no sentence.

Source: BSIG, Article 1 of BGBl. 2025 I Nr. 301 (opens in a new tab), § 30(2) sentence 2 no. 4 and § 30(3) · Checked on

  • NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union.
  • NISV 2026 is Austria's Netz- und Informationssystemsicherheitsverordnung 2026 (BGBl. II Nr. 290/2026).
  • BSIG is Germany's BSI Act, the Gesetz über das Bundesamt für Sicherheit in der Informationstechnik.

Keeping this current across many suppliers? Vittnor — Supply Chain Assurance for the mid-market — keeps the register, the evidence and every decision in one place, and records who decided what, when and why. The pilot is open now, and pilot members help shape the first release. A Free plan for up to 5 suppliers opens soon.

Join the pilot

Tell us what's missing

If the policy leaves out something you need, tell us. When the kit changes, its version goes up and the change is listed with its date.

Write to us

Vittnor by Shards Cybersecurity · shardscybersecurity.io · version 1.2 · last reviewed 20 October 2026

Licence: CC BY 4.0. Free to use inside your organisation, and to show to your auditors and suppliers. If you publish it or hand it out as a template, keep the credit line and say what you changed.

This kit supports your Article 21(2)(d) work; it is not legal advice. It lists contract terms to look for, but doesn't judge whether a contract is adequate. No tool or template makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it.