NIS2 supplier assessment checklist
Twenty-three checks for assessing a supplier under NIS2 Article 21(2)(d) and 21(3), from scope to follow-up. Use it on screen, print it, or download it as a spreadsheet template.
Last reviewed
NIS2 asks you to manage the security of your supply chain, and to take into account each direct supplier's vulnerabilities and the quality of its cybersecurity practices. It does not prescribe how. This checklist turns that into concrete checks, one supplier at a time.
Section 2 can be done without asking the supplier anything: it is the public evidence a scan collects, and each check links to the module that explains it. The other sections need the supplier's answers, documents or your contract. To print it or save it as a PDF, use your browser's print command.
1. Scope: which suppliers, and how critical
The supplier is on your list of direct suppliers and service providers.
Evidence: Your supplier register
You have recorded whether it holds your data, runs a service you depend on, or connects to your systems, and given it a risk tier.
Evidence: Your tiering decision
Someone in your organisation owns the relationship and the follow-up.
Evidence: Named owner
2. Outside-in evidence: what you can check without asking
The supplier's mail domain publishes SPF and an enforcing DMARC policy (quarantine or reject).
Evidence: DMARC and SPF records · Checked from the outside: Email security
Its websites and portals serve HTTPS with a valid certificate, redirect HTTP to HTTPS and do not accept outdated TLS versions.
Evidence: Certificate, TLS versions, redirects · Checked from the outside: TLS and web hygiene
Its websites send the basic security headers, including HSTS.
Evidence: HTTP response headers · Checked from the outside: TLS and web hygiene
No public software it runs advertises a version with a known exploited vulnerability.
Evidence: Advertised software versions against known vulnerabilities · Checked from the outside: Vulnerabilities
No unexpected services are exposed to the internet, and lookalike domains are known.
Evidence: Subdomains, open ports, lookalike domains · Checked from the outside: Attack surface
The domain and its IP addresses are not on malware, phishing or botnet lists.
Evidence: Threat-intelligence lists · Checked from the outside: Reputation
The supplier is not named in a recent claim on a ransomware leak site.
Evidence: Ransomware leak-site trackers · Checked from the outside: Ransomware exposure
3. The supplier's own controls: ask for evidence
If the supplier cites ISO 27001 or a SOC 2 report, its scope covers the service you buy.
Evidence: Certificate with scope statement, or the report
Multi-factor authentication protects every account that can reach your data or systems.
Evidence: Supplier statement, policy extract
Vulnerabilities are handled with defined timelines, critical ones first.
Evidence: Vulnerability management procedure
Backups of your data exist, are protected and have been restored in a test.
Evidence: Backup and restore test record
The supplier has an incident response process with a named contact.
Evidence: Incident procedure, contact details
The supplier lists the subcontractors involved in delivering your service.
Evidence: Subcontractor list
4. The contract
The security requirements the supplier must meet are written into the contract.
Evidence: Contract clause
The supplier must tell you about incidents affecting you quickly enough for you to give your own early warning within 24 hours (Article 23).
Evidence: Contract clause with a time limit
You have the right to ask for evidence, and to audit where the risk calls for it.
Evidence: Contract clause
The contract says what happens to your data, and how you exit, when it ends.
Evidence: Exit and data return clause
5. Decision and follow-up
You have recorded the decision (accept, accept with conditions, or reject) and the risk that remains.
Evidence: Signed-off assessment
Agreed fixes have owners and dates.
Evidence: Action list
The next review is planned: yearly for the top tier, at renewal, and after a change or an incident.
Evidence: Review date
The checklist is a starting point, not a legal standard. Adapt it to your suppliers and to the guidance of your supervisory authority. The guide to NIS2 supplier security explains the requirements behind it, and vendor risk management, step by step shows how the checks fit into a process.
Do section 2 now
Enter a supplier's domain and see the outside-in evidence for every check in section 2. The supplier is not contacted.