Step 1 of 4 · Scope

Which suppliers matter

Start from the whole list, then keep the suppliers that matter for your cybersecurity. Anything you leave out needs a reason you can show later.

This step produces:

01A maintained supplier inventory tagged by service and data

Start from everyone you buy from

The supply chain clause of NIS2 includes "security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Directive (EU) 2022/2555, Article 21(2)(d)). So the list starts with every company you buy from directly, not only the IT ones. A payroll provider holding your staff's personal data, or a maintenance contractor with remote access to a production line, can matter as much as your software suppliers.

Decide what is in scope once the list is complete, not while you build it. A supplier that doesn't matter is quick to rule out, and the record shows you looked. Your suppliers' own suppliers are listed separately: they come in through question 9 in Step 2 and the sub-processor lists you read in Step 3.

Where to find them

Good places to look: accounts payable, your contract register, your GDPR processor list, the apps connected to your identity provider, and the accounts used for remote access.

Use all five: any one of them can reveal a supplier the others miss. Accounts payable shows the small suppliers that never went through IT. Your identity provider shows the online tools people sign in to with their work accounts, including any a team took up without a purchase order. The remote-access accounts show who can reach your systems from outside: support companies, maintenance contractors, the supplier of a machine on your shop floor.

What each one provides, and one owner

For each supplier, note what kind of supplier it is, such as a cloud service, a software supplier, a managed service provider or a consultant, and which services it provides. A supplier can be more than one kind. Then name one owner on your side: the person who knows what the service is used for and answers for the relationship. One person, not a team, so every question has somewhere to go.

The whole supplier, or service by service

Scope a supplier as a whole when everything it provides carries the same kind of risk. Treat each service on its own when they differ: a provider that hosts your production system and also runs your payroll would get different answers for each, and one set of answers would hide one of them. Each service you treat on its own gets its own answers, tier and decision. If you are not sure, start with the whole supplier and split it when the answers pull apart.

Decide what is in scope: five questions

Each question asks about one way a supplier can affect your cybersecurity: through your data, through access to your systems, through your operations, through what it puts into your systems, or because someone else requires you to assess it.

The five scope questions, and when an answer counts as in scope
Question	Counts as in scope when…
1Which of your data can it see or hold?	personal, confidential or internal data
2Does it have access to your systems?	any access, limited or privileged
3Would an outage or incident there disrupt your operations or the services you provide?	yes
4Does it supply software, devices or updates that run in your systems?	yes
5Does a contract, a customer or another law require you to assess it?	yes, for example as a GDPR processor

One answer that counts as in scope makes the supplier in scope.

One answer is enough because each question is a separate way in. A supplier that never sees your data can still stop your operations if it fails, so a "no" to one question doesn't cancel a "yes" to another.

Not sure about question 3? On its own, "not sure" doesn't make the supplier in scope. Note it, and find out.

Out of scope needs a reason you can show later

An "out of scope" with no reason looks the same as a supplier nobody checked. Write the reason in one line, from the answers, for example: "Office supplies: no data, no access to our systems, no effect on operations if it stops." The same goes for any supplier you mark in or out against what its answers say.

The reason is for whoever asks later: your successor, an auditor or a competent authority. One line written now saves reconstructing the decision from memory.

New suppliers too

Run the same four steps before you sign a new supplier, while the contract is still open for discussion. The five questions tell you whether the new supplier will be in scope. If it will, assess it as in Step 2 and check the draft contract against the eight terms in Step 3.

Checklist

Every supplier is on it. Good places to look: accounts payable, your contract register, your GDPR processor list, the apps connected to your identity provider, and the accounts used for remote access.
Each supplier has one owner on your side.
For each one, you know what kind of supplier it is and which services it provides. If one supplier gives you very different services (say, hosting and payroll), treat each service on its own.
All five questions are answered for every supplier, or for every service you treat on its own.
Each one is marked in scope or out of scope.
Every "out of scope" has a written reason. So does any supplier you mark in or out against what its answers say.

Ticks aren't saved. The same checklist is in the PDF.

In the Excel file, record this step in the first columns of the Steps 1-2 Register sheet.

End of Step 1 of 4

Next: Step 2How much risk each supplier brings

For each supplier in scope, answer twelve questions, then set a tier: Low, Medium, High or Critical.

Back to the kit overview

Vittnor by Shards Cybersecurity · shardscybersecurity.io · version 1.2 · last reviewed 20 October 2026

Licence: CC BY 4.0. Free to use inside your organisation, and to show to your auditors and suppliers. If you publish it or hand it out as a template, keep the credit line and say what you changed.

This kit supports your Article 21(2)(d) work; it is not legal advice. It lists contract terms to look for, but doesn't judge whether a contract is adequate. No tool or template makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it.