NIS2 Supply Chain Security (Art 21(2)(d)): Assessing Suppliers and MSPs

Programme Building Blocks

• Inventory of direct ICT/OT suppliers and MSPs with access or processing roles
• Risk-tiering (criticality, data/system access, substitutability)
• Contractual security clauses and audit/assurance rights
• Ongoing monitoring (attestations, questionnaires, incident notice SLAs)
• Offboarding and access revocation drills

When Your Supplier Is Also In Scope

Many MSPs/MSSPs are themselves NIS2 entities. Customer due diligence and provider self-compliance reinforce each other — see NIS2 for MSPs.

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Does Article 21(d) require assessing every SaaS tool?

Focus on direct suppliers/service providers that materially affect network and information security risk — tier depth by criticality.

Are contractual clauses enough?

Contracts help; supervisors also expect risk assessment, monitoring, and incident-notification paths.

How does this relate to DORA ICT third-party risk?

Financial entities may have stricter DORA duties; map both frameworks if both apply.

Related NIS2 Resources

NIS2 hub · MSPs · CSA