Article 21Supply Chain

EU NIS2 Directive (EU) 2022/2555 Supply Chain Security Program

Operationalise Article 21(d) with vendor tiering, assurance, and incident communications.

Output: a repeatable third-party security program with audit-ready evidence.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

NIS2 explicitly requires supply chain security as part of Article 21 risk management measures. The fastest way to fail is to treat suppliers as "outside the perimeter". This page gives you a practical program structure you can implement and maintain.

Section 1

What Article 21(d) expects (and what it means operationally)

Article 21 includes supply chain security, including security-related aspects of relationships between each entity and its direct suppliers or service providers.

Create supplier tiering based on impact: managed services, critical infrastructure, data access, and operational dependency.
Define security requirements per tier: authentication, logging, vulnerability handling, incident notification, and resilience expectations.
Build continuous assurance: not only a procurement questionnaire - you need evidence and recurring reviews.
Include supplier incident communications in your Article 23 incident workflow (timelines, contacts, and data requirements).

Section 2

Program design (the minimum components that make it work)

A defensible supply chain program is simple but strict: tiering, controls, contracts, and evidence.

Inventory: maintain a live list of direct suppliers and service providers, with data access and criticality tagging.
Onboarding: due diligence + contract clauses + technical onboarding controls (SSO/MFA, network segmentation, least privilege).
Ongoing assurance: periodic reviews, evidence requests, and service-level security KPIs.
Offboarding: access removal, data return/destruction, and termination runbooks.
Incident communications: defined notification timelines, contact paths, and required incident payload fields.

Section 3

Evidence pack (what you should be able to show during audits)

Supervisory authorities can request evidence of cybersecurity policies and implementation. Supply chain evidence should be indexed and easy to retrieve.

Supplier register with tiering rationale and periodic review dates.
Standard security clauses / addenda per tier (incident notification, vulnerability handling, access control, audit rights where appropriate).
Due diligence records and decisions (including exceptions and compensating controls).
Supplier performance KPIs and review minutes.
Supplier incident communications log and lessons learned integrated into Article 21 improvements.

Section 4

A 60-day rollout plan (pragmatic sequencing)

Start with the suppliers that can cause the biggest operational impact, then expand.

Days 0-14: build tiering model + supplier inventory; identify "critical suppliers" list.
Days 15-30: implement contract addendum for critical tiers; define incident communications requirements.
Days 31-45: implement technical onboarding/offboarding controls; tighten privileged access and logging for supplier access.
Days 46-60: run first supplier reviews and document evidence pack; integrate into management reporting cadence.

Recommended next step

Turn EU NIS2 Directive (EU) 2022/2555 Supply Chain Security Program into an operational assessment

Assessment Autopilot can take EU NIS2 Directive (EU) 2022/2555 Supply Chain Security Program from turning this guidance into an operational assessment workflow to a reusable workflow inside Sorena. Teams working on EU NIS2 Directive (EU) 2022/2555 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU NIS2 Directive (EU) 2022/2555 Supply Chain Security Program

Start from EU NIS2 Directive (EU) 2022/2555 Supply Chain Security Program and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU NIS2 Directive (EU) 2022/2555

Review your current process, evidence gaps, and next steps for EU NIS2 Directive (EU) 2022/2555 Supply Chain Security Program.

Explore next step

Primary sources