NIS2 supplier security: what Article 21 asks, and what outside-in evidence shows

NIS2 is the EU directive on a high common level of cybersecurity, Directive (EU) 2022/2555. It asks organisations in scope to manage cybersecurity risk, and it names the supply chain as one of the risks. This guide sets out what the text says, how that reaches suppliers who are not in scope themselves, and a supplier process you can run. It ends with where outside-in evidence, such as an TrustSek scan, fits.

What Article 21 says

Article 21(1) requires essential and important entities to take “appropriate and proportionate technical, operational and organisational measures” to manage the risks to their network and information systems. Proportionate is the key word: the measures should fit the entity's exposure, its size, and the likelihood and severity of incidents.

Article 21(2) then lists the measures that must be included, as a minimum. Point (d) is about suppliers:

“supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”

Article 21(3) says what to take into account when deciding which supply-chain measures are appropriate:

“the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures”

The same paragraph adds the results of the EU's coordinated risk assessments of critical supply chains under Article 22(1).

Three things follow from the text.

1. The focus is direct suppliers and service providers. The directive does not ask you to map every supplier's suppliers, although your assessment of a direct supplier can reasonably include how it manages its own.
2. It asks for judgement, not a checklist. You decide which measures are appropriate, based on each supplier's specific vulnerabilities and the quality of its practices.
3. It sits alongside the other Article 21 measures. Incident handling, business continuity, access control, cryptography and the rest all touch suppliers too, for example when a supplier holds your data or runs a system for you.

Article 20 makes the entity's management body responsible for approving these measures and overseeing how they are implemented. Supplier security is therefore a management matter, not only a procurement one.

For some digital service providers, such as cloud, data centre, managed service and managed security service providers, Commission Implementing Regulation (EU) 2024/2690 sets out the technical and methodological requirements in more detail, including for supply chain security. If you are one of those entities, read its annex alongside Article 21.

Who it applies to, and how it reaches suppliers

NIS2 applies to entities in the sectors listed in its Annexes I and II. As a general rule, they must be at least medium-sized, although some types of entity are covered whatever their size (Article 2). Article 3 divides them into essential and important entities, which differ mainly in how they are supervised.

Many suppliers are outside that scope: a small software house, a payroll bureau, a local IT provider. The directive still reaches them, indirectly. The entity in scope must manage the risk its suppliers bring, so it passes requirements down through contracts, questionnaires and reviews. A supplier that is not regulated itself can find that its customers now expect evidence of how it protects the service it provides.

Each member state transposes the directive into national law, and the national law is what applies. In Sweden, that law is the Cybersecurity Act, cybersäkerhetslagen (SFS 2025:1506), which applies from 15 January 2026. The Act leaves supervision to the authorities the government appoints (chapter 3, section 1), so look to the authority the government appoints for your sector for its regulations and guidance.

A practical supplier process

There is no prescribed method in the directive. The steps below are a common, proportionate way to meet Article 21(2)(d). Scale the depth to the supplier.

1. Make an inventory. List your direct suppliers and service providers, what each one delivers, which of your systems and data it touches, and who owns the relationship on your side.
2. Rank them by criticality. Ask what happens if the supplier is compromised or unavailable. A supplier with administrative access to your network, or one that runs a service your customers depend on, is critical. The office coffee supplier is not.
3. Set requirements. For critical suppliers, write security requirements into the contract: the controls you expect, incident notification to you within an agreed time, your right to ask for evidence or audit, rules for their subcontractors, and what happens to your data when the contract ends.
4. Assess before you sign. Use what fits the supplier's criticality: a questionnaire, a certification such as ISO/IEC 27001 with its scope checked, an assurance report such as SOC 2, a conversation with their security lead, and external evidence.
5. Follow up. Reassess at set intervals and when something changes: a new service, a merger, an incident, a change of hosting. Record what you checked and what you decided.
6. Plan for exit. Know how you would replace a critical supplier, and how your data and access would be returned or removed.

Keep records. When a supervisor asks how you manage supply chain risk, a documented process with dated evidence is what answers the question.

Where outside-in evidence fits

An outside-in scan looks at a supplier's domain the way anyone on the internet can: its email authentication, how its web services are encrypted, its exposed services, software versions it advertises, its presence on threat and ransomware lists. TrustSek does this without asking the supplier for anything and without access to their systems. The checks are non-intrusive: besides public sources, a scan makes one TLS handshake and ordinary web requests to the domain, as a browser would, and no port scans. See the methodology for how the evidence is collected and scored.

That makes it useful in a few specific places in the process:

• Triage across many suppliers. Before you send a long questionnaire to everyone, a score per supplier shows where to look first.
• Evidence about practices, not only claims. Article 21(3) asks you to consider the quality of a supplier's cybersecurity practices. An expired certificate, a DMARC policy that does nothing, or a known-exploited vulnerability on a public server is observable evidence about those practices.
• Specific questions. A finding gives you something concrete to raise: “Your mail domain does not enforce DMARC. When will it?” is easier to follow up than a general question about email security.
• A dated record. Each result records when it was collected and which scoring policy produced it, which helps when you document your follow-up.

TrustSek also maps findings to Article 21 measures: points (e), (g), (h) and (j), covering web security baselines, email and web cyber hygiene, cryptography and forced HTTPS. The NIS2 compliance page lists each mapping. When you scan a supplier's domain, those mappings describe the supplier's own measures, not yours. They are evidence you can take into account under Article 21(3), not a result against point (d).

You can track suppliers in TrustSek alongside your own domain. See solutions for companies for how that works.

Where it does not fit

Most of what makes a supplier safe is invisible from the outside. A scan cannot show:

• whether the supplier has a risk-management process, incident response or business continuity plans
• how it controls access to your data, or whether it uses multi-factor authentication
• whether its staff are trained, or who in its organisation can reach your systems
• which subcontractors it uses, and how it manages them
• what your contract says, or whether the supplier meets it

A scan also reads only public signals at one point in time. A clean result means none of the checked signals raised a finding; it does not mean the supplier is secure. And a source that could not be consulted is shown as not checked, never counted as clean.

So use outside-in evidence as one input to the process, next to contracts, questionnaires, certifications and conversations. It does not replace any of them, and it does not make you or your supplier compliant with NIS2.

Check a supplier's domain

Enter a supplier's domain, or your own, to see the public evidence a scan collects. No access to the supplier's systems is needed.

Your domain

Check your domain

Free, no sign-up. Takes about 30 seconds.