NIS2 supplier contract clauses

The contract should state the security baseline the supplier must meet, tied to the services it provides, and say how compliance is shown. Where the supplier touches your systems, the clause should name the controls that matter for that service, such as access management, logging, encryption and patching. Implementing Regulation (EU) 2024/2690 expects cybersecurity requirements to be set where appropriate, so write them against the actual service scope rather than a generic checklist.

• Ask for a written security schedule that maps to your Article 21 measures.
• Ask for the supplier's own policies and how they are reviewed.
• Ask for evidence such as recent test results, configuration baselines or an independent certificate, noting that a certificate does not prove every requirement.

The clause should require the supplier to train its staff on security and to screen people who access your systems or data, where that is appropriate to the risk. The implementing regulation allows customers to extend their awareness programs and background checks to direct suppliers and service providers (points 8.1.2 and 10.2.1 of the Annex). Keep the clause proportionate: privileged staff and people with remote access warrant closer checks than staff on unrelated work.

• Ask for a description of the training program, its frequency and who completes it.
• Ask for confirmation that background checks follow local law and are repeated where the role changes.
• Ask for records of completion, not just a policy statement.

The supplier must notify you without undue delay of incidents that affect your services or data, so that you can meet your own reporting deadlines under Article 23. Article 23(1) requires entities to inform service recipients without undue delay where a significant incident is likely to adversely affect service provision. Do not rely on the phrase alone: agree a notification trigger, a contact route and a maximum window in the contract, and test that the route works.

• Ask for a defined list of events that trigger notification.
• Ask for the information the supplier will provide in the first notice and in updates.
• Ask for a named contact and an out-of-hours route.

The contract should give you a right to audit the supplier or to receive audit reports, so you can verify that the commitments are met. Many customers accept an independent audit report as a starting point, then keep the right to a targeted assessment after an incident or a significant change. Be precise about what a report covers, its period and its scope, because a report on one service does not cover another.

• Ask for the most recent independent report and the bridge letter for any gap period.
• Ask for notice periods and limits on how often you can audit.
• Confirm whether subcontractors are included in the audit scope.

The clause should require the supplier to find, track, fix and report vulnerabilities in the products and services it delivers, within timeframes you agree. Under the acquisition requirements in point 6.1.2 of the Annex, you should also expect security updates for the product's lifetime or a replacement when support ends, plus information on the hardware and software components. Ask the supplier how it validates delivered products against your requirements before they go live.

• Ask for the supplier's patch and disclosure process and its target timeframes by severity.
• Ask for a component inventory, such as an SBOM, for software you receive.
• Ask what happens when a vendor component reaches end of support.

The contract should say whether the supplier may use subcontractors, which ones, and what security duties flow down to them. Your obligations under Article 21(2)(d) reach your direct suppliers, and the supplier's own subcontractors can create the same exposure. Require prior notice of material changes and the right to object or terminate where a new subcontractor creates unacceptable risk.

• Ask for a current list of material subcontractors and the services they perform.
• Ask that the same security and notification terms apply to them.
• Ask how the supplier reassesses subcontractors over time.

The exit clause should describe how you leave the relationship without losing data or continuity, and the remote access clause should limit how the supplier connects to your environment. Implementing Regulation 2024/2690 expects exit obligations in supplier contracts, and point 6.7.2(h) allows service provider connections only after an authorization request and for a set period, such as the duration of a maintenance operation. Time-limited access with logging is easier to defend than standing access.

• Ask for data return and deletion steps, with timelines agreed in writing.
• Ask for a documented access request for each connection, with an end date.
• Ask that remote sessions be logged and reviewed.

Monitor the supplier against the clauses over the life of the contract, not only at signature. The implementing regulation expects customers to review supplier SLA reports, look at supplier-related incidents and reassess suppliers at planned intervals and after significant changes or incidents (points 5.1.6 and 5.1.7). Keep a register that records each clause, the evidence received, the date and the owner, so that a supervisor can see the process working.

• Ask for the evidence listed in each clause on a fixed schedule.
• Record who reviews SLA reports and how exceptions are escalated.
• Confirm which internal team owns each clause and who signs off a reassessment.

No. NIS2 and the implementing regulation set the topics a contract should address, not model text you must copy. Implementing Regulation (EU) 2024/2690 lists areas such as cybersecurity requirements, staff training and background checks, incident notification without undue delay, audit rights or audit reports, vulnerability handling, subcontracting and exit obligations. Your legal counsel decides how each topic is worded, how much weight each clause carries, and how it fits your existing terms. Your supervisor will look for evidence that each topic was considered and, where appropriate, written into the agreement. Ask counsel to map each clause back to the relevant topic so the link is visible during an inspection.

NIS2 does not require a particular supplier to sign anything. Article 21(2)(d) obliges your organization to address security in its relationships with direct suppliers and service providers, so the duty sits with you. Whether a small supplier needs the full set of clauses depends on what it accesses, handles or operates for you. A supplier with remote access to production systems needs stronger terms than one that supplies office equipment. Where the supplier is too small to negotiate, you can still apply proportionate measures such as security questionnaires, limits on access and documented reassessment. Confirm the approach with your counsel and your national competent authority's guidance, because enforcement practice varies by Member State.

The time depends on the scope of the contract, the number of suppliers, how much each supplier must change, and how many rounds your legal and security teams need. No timeline figure is supplied for this topic, so treat any number you hear as a claim to verify. A short addendum for a low-risk supplier can move quickly. A managed service or cloud agreement with remote access, subcontracting and exit terms usually takes longer because each clause touches operations, liability and pricing. Ask suppliers early which clauses they already accept and which need escalation. Build the negotiation calendar around your contract renewal dates so you are not forced to accept weaker terms under deadline pressure.

DeployOpen does not draft or negotiate contracts and does not provide legal advice. Its role is to prepare systems and evidence for compliance, such as access controls, logging, backup records, vulnerability handling procedures and documentation that supports the clauses your organization agrees. Where your contracts require a specific technical measure, such as time-limited remote access for a maintenance window or a defined incident notification path, DeployOpen can implement and document that measure in the self-hosted platforms it manages. Your legal counsel reviews and finalizes every clause. Independent auditors and certification bodies issue any reports or certificates that a supplier provides.

Your organization owns the contract and the accountability for NIS2 compliance, so several internal steps come first. Start with an inventory of direct suppliers and service providers and the access, data and systems each one touches. Classify them by risk, then agree which clause topics apply to each class. Involve legal counsel, procurement, the security lead and the business owner of each relationship. Confirm that management has approved the approach, since Article 20 places oversight duties on the management body. Finally, set up the monitoring that the contract will rely on: SLA report reviews, supplier incident reviews and planned reassessments. Clauses without a process to enforce them will not satisfy a supervisor.

A certificate can support your assessment, but it does not replace contract terms. NIS2 creates no certificate of compliance, and a supplier certificate shows only what its scope covers on the audit date. The implementing regulation expects you to address incident notification, audit rights or reports, subcontracting and exit obligations in writing, where appropriate. A certificate does not give you the right to receive an incident notice, to limit a subcontractor or to exit cleanly. Use the certificate as one input to your supplier review and keep the contractual rights as a separate requirement. Ask counsel to confirm the exact rights your contract needs.

Your options are to accept a documented residual risk with management approval, limit what the supplier can access, add compensating controls on your side, or replace the supplier. Each option should be recorded in your risk assessment with the reason and the owner who accepted it. For suppliers with remote access, you can restrict connections to an authorization request for a set period, such as the duration of a maintenance operation, and log every session. Refusal is also a signal for the reassessment process, so review whether the relationship still fits your risk appetite. Keep the decision and its evidence on file, because your supervisor will ask how the gap was handled.

Your contract should say whether the supplier may subcontract, under which conditions, and what notice you receive. Ask for a current list of material subcontractors, require that they meet equivalent security terms, and keep the right to object or terminate if a change weakens protection. Confirm that incident notification and audit rights flow down to the subcontractor or are otherwise available to you. Subcontracting questions also belong in your reassessment cycle, because a change in the supply chain is a significant change that should trigger a review. Confirm the exact flow-down wording with your counsel, since it depends on the contract and the jurisdiction.