NIS2 and subcontractors: are you affected indirectly?

Why NIS2 affects you without naming you

Directive (EU) 2022/2555 directly regulates only essential and important entities (see the 5-question test). But its Article 21, paragraph 2, point (d), requires these entities to take measures covering 'supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers'. Paragraph 3 adds that they must take into account the vulnerabilities specific to each direct supplier and the overall quality of its cybersecurity practices.

The mechanism is therefore contractual: the obligation falls on your client, who passes it on to you. This is exactly the pattern experienced under the GDPR with data processors in 2018, with one difference: NIS2 targets the security of the entire service relationship, not just personal data.

Who is affected indirectly, in concrete terms?

Three types of suppliers are on the front line:

1. Digital service providers to regulated entities: managed services, application maintenance, vertical SaaS publishers, hosting providers not directly covered, integrators. Caution: some of these activities actually fall within the direct scope of NIS2 (managed service providers and managed security service providers, cloud, data centres are listed in Annex I); check your own applicability first.
2. Suppliers critical to continuity: logistics, industrial maintenance, laboratories, component suppliers, where their failure would disrupt the service of the regulated entity.
3. Subcontractors with access to the client's information system: remote maintenance, support, developers, HR or payroll service providers with connectivity. Remote access is the primary attack vector through the supply chain.

What your clients will ask you for

Practices are quickly becoming standardised. Expect to receive, often from the tender stage onwards:

• A security questionnaire (50 to 300 questions) covering the 10 families of measures in Article 21: governance, incident management, continuity, access control, encryption, MFA, training, vulnerability management.
• Contractual clauses: obligation to notify any security incident affecting the service within a short timeframe (often 24 to 72 hours), commitment to minimum measures, right to audit, reversibility plan, cyber insurance.
• Evidence: security policy, penetration testing certificates, certifications (ISO 27001, SecNumCloud for trusted cloud, HDS in healthcare), audit results.
• Periodic reassessment: supplier compliance is no longer a check at signature but an annual review.

The forward-thinking supplier's checklist

1. Clarify your status: are you within the direct scope (in which case your obligations extend far beyond contractual requirements) or only indirectly affected? The 5-question test takes ten minutes.
2. Assess the 10 measures of Article 21 on your own information system: this is the framework against which your clients will evaluate you. The NIS2 self-assessment provides an initial measure.
3. Prepare a reusable trust file: dated security policy, organisation (designated person in charge, even if outsourced), incident procedure with notification commitment, tested backups, widespread MFA, proof of staff awareness training.
4. Control your own critical suppliers: the cascade does not stop with you, and your clients increasingly check tier 2.
5. Negotiate workable clauses: a 24-hour notification deadline is negotiable (nature of covered incidents, starting point of the deadline, channel); an untenable commitment will backfire at the first incident.

The constraint that becomes a commercial argument

In regulated sectors, the ability to respond within 48 hours to a security questionnaire with a clean file now wins tenders. Buyers silently eliminate suppliers unable to produce a security policy or proof of MFA. Conversely, displaying an up-to-date compliance framework and maturity score shortens sales cycles. Suppliers who have industrialised their trust file transform a suffered constraint into a measurable competitive advantage.

Sources

• Directive (EU) 2022/2555 (NIS2), Article 21, paragraphs 2 and 3, and Article 22 (coordinated security risk assessments of critical supply chains), EUR-Lex.
• The French cybersecurity agency (ANSSI), MesServicesCyber, 'Directive NIS 2' and Référentiel Cyber France (ReCyF).
• ENISA, Good Practices for Supply Chain Cybersecurity.