NIS2 Article 21 Supply Chain Security Program

Article 21(2)(d) names supply chain security as one of the measures that must be included in an all-hazards cybersecurity risk-management baseline. The program should therefore be tied to the entity's network and information systems, services, and direct supplier or service-provider relationships.

Article 21(3) makes the supplier review more specific: entities must take into account vulnerabilities specific to each direct supplier and service provider, the overall quality of products, the cybersecurity practices of suppliers and service providers, and their secure development procedures. Where Article 22 coordinated risk assessments of critical ICT supply chains are relevant, those results also need to feed the program.

For digital-sector entities covered by Implementing Regulation (EU) 2024/2690, the Annex requires a supply chain security policy governing relations with direct suppliers and service providers. ENISA's guidance explains that the policy should identify the entity's role in the supply chain and communicate that role to direct suppliers and service providers where possible.

Supplier selection should not be limited to price, availability, or a questionnaire score. The program should record selection and contracting criteria that cover cybersecurity practices, secure development, ability to meet cybersecurity specifications, jurisdictional and ownership considerations where relevant, supply resilience, supplier incident history, and lock-in risk.

The implementing regulation expects supplier and service-provider contracts to specify appropriate security clauses. ENISA's guidance lists practical clause areas such as cybersecurity requirements, supplier staff awareness or certification requirements where appropriate, background-verification requirements where appropriate, incident notification to the entity without undue delay, vulnerability handling, termination obligations, audit rights, cooperation with competent authorities, and exit arrangements.

These clauses should be operational, not decorative. The program should connect them to onboarding, access control, vulnerability reporting, secure acquisition, maintenance windows, incident communication, service continuity, data return or disposal, and supplier offboarding.

A NIS2 supply chain security program should produce evidence that can be reviewed by management, auditors, and competent authorities without reconstructing the supplier story from email. The evidence should show which suppliers are direct suppliers or service providers, what they provide, how they were assessed, which contract requirements apply, and how their risk is monitored over time.

For covered digital entities, ENISA points to evidence such as the supply chain security policy, evidence that the entity's role was communicated to suppliers where possible, supplier and service-provider evaluation records, risk analysis results, contract or SLA evidence, incident records tied to suppliers, supplier exit documentation, and a registry of direct suppliers and service providers.

The first trap is treating every vendor the same. NIS2 focuses on risk to network and information systems and services, so a direct supplier of critical ICT services should receive deeper review than a low-risk administrative vendor. The second trap is treating a certificate as a complete answer; certificates can support assurance, but Article 21 still requires the entity to consider supplier-specific vulnerabilities and cybersecurity practices.

Free and open source software also needs careful handling. ENISA notes that open communities may not be direct suppliers or service providers where there is no contractual relationship beyond a standard licence, but direct suppliers that integrate open source components can still be asked for risk assessment, maintenance, dependency, and vulnerability evidence.

Use this checklist to turn Article 21 supply chain obligations into an auditable program. It should be adapted to the entity's sector, Member State implementation, service criticality, and supplier risk profile.

The checklist is strongest when procurement, security, legal, business continuity, incident response, and management reporting use the same supplier inventory and risk records.