NIS2 turns supplier security into a contract negotiation

Supply chain security is about more than technical controls

You can't tell a supplier how to run their business, but you can set the conditions under which they can access yours.

NIS2 requires companies to address security risks in their supply chains, and Article 21(2)(d) puts responsibility on the buyer. If a supplier’s compromised credentials give an attacker access to your systems, you still own that risk under NIS2; it does not vanish simply because the security failure didn’t start with you.

That puts more weight on the terms agreed before a supplier gets access to your systems. If a vendor suffers a breach, you need to know whether they must notify you, how quickly, and under what circumstances. If you need to audit their security controls, you must have the authority to do so in the first place.

Supply chain security is much more than having the technical controls in place. It predominantly comes down to negotiation and agreement within the broader business contract.

Key insights

1. NIS2 Article 21(2)(d) makes the buyer responsible for supply chain security risk, including breaches that originate with a supplier.
2. The contract should set incident notification triggers, timelines and audit rights before access is granted.
3. A signed security questionnaire records what a vendor claims; audit rights written into the agreement let the buyer verify it.

Supplier access should be time-limited, logged, and attributable, with contract end dates matching access end dates.

Security requirements belong in the contract

Security teams have limited control over how a supplier runs its business. But they have considerably more say over the conditions under which that supplier gets access to theirs.

Dr Yiannis Pavlosoglou, Deputy Governor at the Greek National Cybersecurity Authority, describes the contract as one of the strongest controls available for managing supply chain risk:

“The negotiation took ten months. But unless we agreed on how we would treat the suppliers in terms of indemnification clauses, liabilities and the softer but equally as important KPIs there was no point in moving forward with the Return of Security Investment (ROSI) the third party would provide.”

The contract should spell out when a supplier must report a security incident and what triggers that obligation. Audit rights may also need to cover who pays for the audit and what evidence the supplier must provide.

Even defining the relationship can become important, including who counts as a supplier and which relationships require identities and access to be created.

NIS2 gives security more leverage

Security requirements can add friction to a supplier negotiation, particularly when your legal department is already working through the commercial terms and questions of liability or insurance.

NIS2 gives security teams a reason to take those agreements back to legal and review the terms covering key suppliers, especially those with access to critical systems or confidential information.

The wording matters. These requirements might end up buried in indemnification clauses and cyber insurance provisions, where small changes in wording can affect what each party has agreed to do.

A NIS2 access management report from European password and secrets manager Passwork puts the same question to national regulators and independent experts: when a supplier has access to your environment, how do you prove that access is being controlled?

A signed questionnaire is not proof

Security questionnaires are an expected part of supplier due diligence. They can establish what controls a vendor claims to have, but the buyer still needs evidence where the risk warrants it.

That is important for suppliers with access to sensitive systems or data. Audit rights written into the agreement give the buyer a way to verify controls rather than relying entirely on self-reporting.

Your direct vendor may also depend on contractors or other providers of its own, so access and security requirements may need to account for parties further down the supply chain.

For organisations deciding what to put into procurement requirements, ENISA has published guidance on cybersecurity requirements for ICT products and services, which is a useful starting point for what to ask suppliers to meet.

The contract can establish what the supplier owes you. You still need to control what happens to its access on your side.

The contract ending should end the access

A vendor may need access for a project that lasts a week, several months, or years. The credential should not outlive the work.

Ioannis Ntokos, IT Governance Risk & Compliance Expert (former FedEx, PwC and Randstad), has seen suppliers retain access to systems after the companies that hired them had effectively forgotten about the relationship. He advises establishing “Exit strategies, making sure that you have an offboarding process for vendors and that the lifecycle of vendors is managed and maintained.”

Supplier access can be time-limited from the start. When the engagement ends, credentials must be rotated or revoked rather than waiting for someone to remember that an old account still exists.

Logging matters here as well. If a supplier uses your systems, its activity needs to be attributable so you can establish what happened if an incident occurs.

The dates in the contract and the dates in the access system need to agree. If an engagement finishes on Friday, access should not still work on Monday because nobody told IT that the paperwork had been signed.

The difficult clauses are there for a reason

Supply chain security is one of the harder parts of NIS2 to operationalise because companies cannot dictate everything their suppliers do.

Supplier security requirements also have to work across businesses with different levels of cybersecurity maturity. Some vendors will already have established controls and evidence to support them. Others may be encountering formal security requirements from customers for the first time.

Trust and transparency add to the difficulty. A contract that took ten months to finalise may sound excessive when the business is waiting to start work. But the clauses holding it up could well determine whether a supplier has to tell you about a breach, whether you can check its controls, and what happens to its access when the relationship ends.

Joe Petit is MD of Bora.