Article 21(2)(d) Supply chain security

An assessor starts with the written supply chain security policy and checks whether it sets out how suppliers are chosen and approved. The test is a document review followed by interviews with the people who apply the policy. The assessor wants to see that selection criteria cover cybersecurity practices, the supplier's ability to meet security specifications, product quality and resilience, and the ability to diversify supply and avoid vendor lock-in. Evidence usually includes the approved policy with version history, the criteria checklist used during procurement, and records of past supplier approvals or rejections.

• Policy approval: Confirm the policy has an owner, a management approval date and a review cycle.
• Criteria applied: Pull a sample of recent supplier onboarding files and check each one against the stated criteria.
• Lock-in analysis: Look for documented exit options or a rationale where a single supplier is critical.
• Typical finding: Criteria exist on paper, but procurement records show no evidence they were applied.

Before the assessment, check that the policy names who decides, and that a sample of onboarding files can be produced within a day.

The assessor then compares the supplier registry against other records to see whether it is complete and current. The test is a reconciliation: the registry is matched against accounts payable, contract databases, cloud billing, identity provider integrations and network access lists. The assessor expects each entry to carry a contact point and a description of the ICT products, services and processes the supplier provides. Gaps tend to appear where teams buy software or SaaS tools on corporate cards or through business units that never register with procurement.

• Completeness test: Compare the registry with payment records and active SaaS subscriptions for a fixed period.
• Contact points: Check that each entry names a reachable contact and that the contact is still employed or still valid.
• Service description: Confirm that each entry states what the supplier provides and which systems it touches.
• Typical finding: Registry entries for managed service providers exist, but subcontractors they rely on do not appear.

Before the assessment, reconcile the registry against at least two independent data sources and record how unregistered suppliers are handled.

For each high-impact supplier, the assessor reads the contract and the security schedules to test whether the required clauses are present, where they are appropriate. The test is a clause-by-clause review against the list the implementing regulation sets out, adjusted to the service. Typical clauses cover cybersecurity requirements, staff training and background checks, incident notification without undue delay, a right to audit or receive audit reports, vulnerability handling, subcontracting rules and exit obligations. The assessor also checks whether the clauses are enforced in practice, for example through received audit reports or incident notices.

• Clause coverage: Map each required topic to a clause number for every high-impact contract.
• Notification timing: Check that the notification obligation is tied to a deadline the entity can meet under its own reporting duties.
• Audit rights: Confirm the entity can obtain audit reports or assessments, and that these were requested.
• Subcontracting and exit: Look for flow-down of security duties to subcontractors and a defined exit plan with data return.
• Typical finding: Older contracts lack incident notification timing or any exit provisions.

Before the assessment, prepare a clause map for the most critical suppliers and identify contracts that predate current requirements.

The final area is the risk assessment of individual suppliers. The assessor checks whether the entity considered each direct supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices, including secure development, and relevant EU coordinated risk assessments of critical supply chains. For managed security service providers, the assessor expects heightened diligence because of their close integration in operations. The test is a sample review: the assessor picks several suppliers and asks for the assessment file, the risk rating, the evidence reviewed and the treatment decision.

• Assessment file: Confirm each sampled supplier has a dated assessment, a risk rating and a named reviewer.
• Evidence reviewed: Look for security questionnaires, certifications or audit reports, and vulnerability history.
• Coordinated risk inputs: Check whether relevant EU coordinated risk assessments were considered and recorded.
• Follow-up: Verify that findings led to actions, reassessment or a documented acceptance by management.
• Typical finding: Assessments are completed at onboarding and never refreshed, even after incidents at the supplier.

Before the assessment, schedule reassessments for critical suppliers and keep a record of decisions where the entity accepted residual risk.

Your organization owns the supplier security program. Management is accountable for the Article 21 measures under NIS2, including supplier risk, and must approve the policy, accept residual supplier risk and make the decisions that a partner cannot make for you. Your security, procurement and legal teams carry the day-to-day work of applying the supplier selection criteria and signing contracts.

• Policy ownership: Your team approves the supply chain security policy and assigns an owner who answers for it to management.
• Supplier decisions: Your team decides which suppliers are selected, accepted with conditions or rejected, and documents the reasons.
• Contract signature: Only your authorized signatories agree the clauses that bind suppliers, including incident notification, audit rights and exit obligations.
• Accountability of management: Management reviews supplier risk, approves exceptions and remains answerable to the competent authority for failures, whoever prepared the evidence.
• Ongoing registry upkeep: Your team keeps the registry of direct suppliers current, with contacts and the ICT products, services and processes each supplier provides.

Before engaging any outside party, confirm internally who holds each of these roles and who will sign off the final evidence.

An implementation partner such as DeployOpen helps prepare the systems, records and evidence that your supplier program needs. The partner works inside your environment under a written scope, but it does not own your suppliers, sign your contracts, make risk acceptance decisions or issue any report or certificate. NIS2 creates no certificate of compliance, so no partner can grant one.

• Scoping: The partner helps define which suppliers and service providers fall within the supplier program and agrees deliverables in writing before work starts.
• Registry build: The partner can help structure the supplier registry and populate it from your existing records for your team to validate.
• Tooling setup: The partner can deploy and configure self-hosted tools, for example to track SBOMs and component vulnerabilities, within your infrastructure.
• Evidence preparation: The partner can assemble questionnaires, assessment records, configuration exports and review logs so your team can present them to an assessor.
• Contract clause drafting support: The partner can prepare draft clause language for your legal team to review, adapt and approve.

Ask any partner to state in writing which outputs it prepares, which decisions remain with your team and that it will not issue an audit report or attestation.

An independent auditor, assessor or national competent authority tests whether your supplier controls operate as described. Their role is to examine evidence, interview staff and sample records. They do not prepare your program, and an auditor that helps write your policy or builds your registry would compromise its independence for that engagement.

• Testing: The assessor checks whether the supplier selection criteria were applied to real decisions and whether the registry matches actual suppliers.
• Sampling: The assessor selects contracts and checks for the clauses your policy requires, such as incident notification and audit rights.
• Interviews: The assessor asks management and staff how supplier risk is reviewed, escalated and accepted.
• Supervisory powers: For NIS2, national competent authorities use inspections, security audits, security scans and information requests, and can impose administrative fines under the national transposition law.
• Independence: The assessor reports its own findings, and the entity answers for the outcome.

Confirm with your competent authority or chosen assessor which evidence formats and assessment procedures they expect before you build the evidence set.