YTYK You think you know

Card 5 of 18 Obligations — the ten measures ●●○ Working knowledge

Your suppliers are your perimeter

Supply-chain security is one of the ten measures, and it reaches further than buying from reputable vendors: you must account for the security of your direct suppliers and service providers, and for the quality of their own security practices and development processes.

Why it is like this

Most of the incidents the directive was written after arrived through someone else's software or someone else's access. Regulating only the entity leaves the actual route in unregulated, so the duty follows the dependency.

Not to be confused with

A requirement that your suppliers be in scope themselves. A 12-person software house selling to a hospital is almost certainly out of scope — and the hospital still owes a duty regarding that supplier's security.

In practice

A hospital's NIS2 gap analysis ends with contract clauses and an assessment questionnaire for its imaging-software vendor, which is itself far too small to be an entity under the directive.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 21(2)(d) and Art. 21(3). Read on .

Predict Check yourself

Your critical supplier is a 15-person firm, clearly out of scope. What does NIS2 require of you?

  1. To take their security into account in your own risk measures — their being out of scope does not remove your duty.
  2. Nothing — the duty follows the entity, and they are not one.
  3. To require them to register as an important entity.
  4. To replace them with a supplier that is itself in scope.
Show the answer

To take their security into account in your own risk measures — their being out of scope does not remove your duty.

Article 21(2)(d) places the duty on *you*, regarding your suppliers. Their own scope status is irrelevant to it; what matters is your dependency on them.