NIS2 for IT suppliers: what your clients will ask you

NIS2 is Directive (EU) 2022/2555. A directive does not bind companies directly: each member state transposes it into its own law and names its own competent authority and CSIRT. Scope details, deadlines and penalties can differ from country to country, and a state may go further than the directive (Article 5). Check your country's law and, if your clients are in other member states, theirs too. The European Commission keeps a page per country on the transposition: check its update date, then the national official sources.

The directive applies to entities of the types listed in its Annexes I and II that are medium-sized enterprises or larger (Article 2(1)). So the line is the small-enterprise ceiling: a small enterprise has fewer than 50 employees and an annual turnover or balance sheet total of up to 10 million euros (Recommendation 2003/361/EC).

Before concluding that it doesn't concern you, check three cases:

• You manage clients' systems, even remotely, and you are a medium-sized enterprise or larger. "Managed service providers" and "managed security service providers" are in Annex I, sector 9, "ICT service management (business-to-business)". The definition (Article 6, point 39) covers the installation, management, operation or maintenance of ICT products, networks, infrastructure and applications, "either on customers' premises or remotely". In Annex I, an entity above the medium-sized ceilings is an essential entity, a medium-sized one an important entity (Article 3).
• Your member state has identified you regardless of size, for example because you are the sole provider of an essential service in that country, or because a disruption of your service could cause a significant systemic risk (Article 2(2), points (b) to (e)).
• Your national law covers more than the directive. The directive allows it (Article 5), so read your country's text, not only the directive.

If none of these applies, NIS2 places no direct obligations on you. But if your clients include essential or important entities, their obligations towards suppliers become requests to you.

Article 21 requires NIS2 entities to take cybersecurity risk-management measures that include at least, in paragraph 2, point (d):

"supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers"

And paragraph 3 says how to weigh them: Member States must ensure that,

"when considering which measures referred to in paragraph 2, point (d), of this Article are appropriate, entities take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures."

Article 20 requires the management bodies of NIS2 entities to approve these measures and oversee their implementation, and says they can be held liable for infringements. That is why your client can't settle for a verbal reassurance: it has to be able to show what it asked of its suppliers and how it checked.

When a significant incident occurs, the client must send its CSIRT or competent authority an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report within one month of the notification (Article 23; the three deadlines are explained on the NIS2 page). If the incident starts on a system you manage, those 24 hours also depend on how quickly you tell them.

For some types of entity the Commission has spelled out the measures in Implementing Regulation (EU) 2024/2690: DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. A regulation applies directly in every member state. If you are a managed service provider within the scope of NIS2, it applies to you; if your client is one of these entities, these are the clauses it has to consider for your contract. Other NIS2 entities follow the measures set by their national law and authority, which may be worded differently.

Point 5.1.4 of its annex lists what contracts with suppliers and service providers specify, where appropriate:

Point 5.2 also asks for an up-to-date registry of direct suppliers and service providers, with a contact point for each and the ICT products, services and processes each one provides. Points 5.1.6 and 5.1.7 ask the client to review its suppliers' practices at planned intervals: monitor service level reports, review incidents involving their products and services, and document what it finds.

"Where appropriate" matters: the client chooses which requirements to pass on according to what you supply. Expect different requests from one client to the next.

The measures turn into questions like these, in a questionnaire or a contract annex:

• Which of our systems do you manage, and with what level of access?
• Who has access, with named or shared accounts? Is there two-factor authentication? How do you revoke access when someone leaves?
• How do you handle vulnerabilities and security updates, and what evidence do you keep?
• Do you log and monitor security events on the systems you manage? How long do you keep them?
• If there is an incident, how quickly do you tell us, and with what information?
• Which subcontractors do you use (hosting, tools, cloud services), and where do they process data?
• What happens to data and access at the end of the contract?

There is no "NIS2 supplier" certificate. Getting in order means being able to answer those questions with facts and documents, client by client:

1. Map your NIS2 clients and, for each one, the systems you manage and your level of access. It is the basis of their supplier registry (point 5.2).
2. Put access in order: named accounts, SSH keys instead of passwords, two-factor authentication on panels and consoles, immediate revocation when someone leaves.
3. Patch with a method: a list of open vulnerabilities per server, fix times, and proof of what was applied and when.
4. Record and keep events on the servers you manage, so that you can reconstruct an incident.
5. Write down your incident procedure, with a time to alert the client that fits its 24 hours, and both sides' contacts.
6. List your subcontractors, with the country where each one processes data.
7. Agree the security clauses in the contract, and plan for the periodic review the client has to carry out and document (points 5.1.6 and 5.1.7).

InfraFence covers part of this work on the Linux servers you manage, and gives you evidence to show your client:

• Events and timeline per server: attacks, bans, SSH logins, modified files, and every action taken by a person or by AutoMode, with approvals and undos.
• Vulnerabilities and hardening: hardening checks, vulnerabilities (CVEs) in installed packages and a security score per server, with a monthly report.
• Dashboard access: two-factor authentication for every user and an activity log.
• Incidents: from the events, drafts of the early warning, incident notification and final report for you to review and complete (Pro and AutoMode plans). The NIS2 entity always sends them, never InfraFence.
• A documented subcontractor: InfraFence is run by ComCart Srl, an Italian company; the dashboard and data are in Germany. What the agent reads and sends is described on the Security page, which you can forward to your client.

It doesn't cover the rest: systems the agent doesn't run on, processes, people, contracts. It doesn't decide whether an incident is significant, it sends nothing to any authority or CSIRT, and using it doesn't make you compliant: it helps you show what you do on the servers.

• Directive (EU) 2022/2555 (NIS2), on EUR-Lex: Articles 2, 3, 5, 6, 20, 21 and 23, and Annex I.
• Commission Implementing Regulation (EU) 2024/2690, on EUR-Lex: Article 1 and the annex, points 5.1 and 5.2.
• Commission Recommendation 2003/361/EC, on EUR-Lex: the definition of micro, small and medium-sized enterprises.
• ENISA, the NIS2 Directive.
• European Commission, NIS2 transposition in EU countries: one page per member state, with its contacts.