NIS-2 Supplier Management: Six Steps to a More Secure Supply Chain

What NIS-2 Requires for Supply Chain Security

Germany's NIS-2 implementation law, the BSIG, has been in force since December 2025 and explicitly requires measures for supply chain security in Section 30 (2) No. 4 BSIG. Organizations that operate or establish an ISMS based on ISO/IEC 27001:2022 will find corresponding requirements in Controls A.5.19 through A.5.23.

Section 38 BSIG is also relevant for executive management at covered entities: management must implement the risk management measures and oversee their implementation. Operational tasks can be delegated internally or externally, but responsibility for direction and oversight remains with the organization's leadership.

A systematic NIS-2 supplier management process does not need to become a major project. The basic process–classification, questionnaires, and evaluation–can often be set up within a few hours in a typical mid-sized company. The total effort required for the first full cycle depends largely on how completely suppliers, contracts, access rights, and dependencies are already documented.

This article outlines a practical approach for IT leaders, information security officers, and ISMS managers.

A Realistic Example: Müller & Söhne

To make the approach tangible, we use Müller & Söhne Maschinenbau GmbH—a fictional but realistic sample company with 150 employees, three locations, and connected production systems, including operational technology (OT) components such as machine controls and robots. As a machinery manufacturer with more than 50 employees, the company is directly subject to NIS-2: It qualifies as an “important entity” and must implement the required risk management measures itself—including measures to secure its own supply chain. The scenario is fully built out in our demo environment, from the policy and supplier register to the questionnaires. All examples and figures in this article refer to this fully developed model.

Supplier Criticality Varies: The Three-Tier Model

A common mistake at the outset is to treat every supplier the same. Sending an office furniture supplier the same extensive questionnaire as a data center operator creates effort without a corresponding security benefit–and frustration on both sides.

In our consulting practice, a simple three-tier model has proven effective. The specific classification is not prescribed by law. It does, however, provide a risk-based and transparent foundation for assessing and managing suppliers.

Phase 2: Classify Suppliers

Each supplier is assessed using the four screening questions. The key is to document and justify the classification. This creates the traceability required for internal governance, ISO audits, and–where applicable–regulatory oversight by the German BSI. A statement such as "Tier 1 because the supplier has no IT relevance" may be sufficient, but it must be documented.

Phase 3: Send the Questionnarieres

Tier 2 suppliers receive a compact baseline self-assessment with around 20 questions. Tier 3 suppliers also complete an extended section covering topics such as access logging, data center security, and incident response. Ideally, questionnaires are sent digitally through an ISMS tool: the supplier responds through a web portal, and all answers are documented automatically in an auditable manner.

Practical Tip for the Cover Message: Frame the request as a regulatory requirement rather than a sign of distrust: "Due to regulatory requirements (NIS-2/BSIG), we are required to assess the information security of our service providers." Established suppliers will often already be familiar with similar requests from other customers.

Phase 4: Evaluate Responses and Identify Red Flags

The goal of the evaluation is not to prove that a supplier is perfect. The key is to identify critical gaps–so-called red flags–and address them appropriately. Two examples:

• No patch management process: Known vulnerabilities remain open, creating a direct attack vector that can also affect your environment.
• No commitment to report security incidents: This is especially problematic because, without information from the supplier, you may lose response time and the facts you need for your own incident handling and regulatory reporting.

Red flags do not automatically mean that the supplier must be replaced. The usual response is to set a remediation deadline, implement internal compensating controls, and–if a Tier 3 supplier fails to act–escalate the issue to executive management with a clear recommendation.

Phase 5: Establish Contractual Safeguards (Ongoing, Priority for Tier 3)

Self-assessments create transparency; contracts create binding obligations. For Tier 3 suppliers, contracts should cover availability and recovery SLAs, audit rights, rules for subcontractors, evidence of data deletion at the end of the contract–and, above all, an incident notification obligation: without undue delay and no later than 24 hours after the supplier becomes aware of the security incident.

An important point of context: Your own reporting deadline to the BSI begins only once you become aware of the incident. A late notification from the supplier therefore does not, by itself, mean that you have formally missed a reporting deadline. The value of the clause lies elsewhere, in two ways.

First: response time. If a supplier with remote access is compromised on Friday evening and "reports on Monday," attackers have an entire weekend to use that same access to move into your network. The clause is primarily a damage-containment mechanism, not a compliance formality.

Second: access to the facts. If the incident begins affecting your own operations–for example, because the externally hosted ERP system goes down–your own reporting process is already underway. For a reportable significant security incident at an entity covered by the BSIG, an initial notification is generally due within 24 hours, followed by a more detailed notification within 72 hours and a final notification within one month. For that follow-up, you need information that only the supplier has:

• What happened?
• Which data and access paths are affected?
• What measures are underway?

Without a contractual information obligation, you are operating blind in an incident and may learn the details from the press.

The phrase "after the supplier becomes aware" is deliberate. It does not require a small service provider to maintain 24/7 on-call coverage. It only requires the provider to notify you without undue delay once it has become aware of the incident. For highly critical suppliers–such as data center operators, managed service providers, and cloud providers–it is reasonable to require a professional incident response process. The tiering model is what allows for that distinction.

Phase 6: Ongoing Operations

Supplier management is an ongoing process rather than a one-time project: Tier 3 suppliers are reassessed annually, Tier 2 suppliers every 24 months, and new suppliers are classified before a contract is signed. Event-driven reassessments are added when there is a security incident in the supply chain or when a critical vulnerability becomes known in a supplier's software.

The Real Question: Who Keeps All of This Up to Date?

On paper, the process is manageable. In practice, the challenge is usually ongoing operations rather than the methodology: Excel lists become outdated, email questionnaires require manual follow-up, scheduled reviews are missed, and the connection to risk management ("Which business processes depend on this supplier?") exists only in the heads of the IT team.

This is where the right tooling helps. In an ISMS tool such as Intervalid, which we use in our work, each supplier is recorded as an asset and linked to the applications and processes that depend on it. If a supplier fails or shows critical weaknesses, the affected business processes are immediately visible. Questionnaires are sent and evaluated directly from the tool, and follow-up workflows run automatically.

The approach can go one step further: Within an Autonomous IT Operations model with a higher degree of automation, analysis and recurring tasks can be connected in a controlled way. In our AI-assisted approach, generative AI handles the analysis–it evaluates self-assessments, identifies red flags, and suggests measures and contract clauses. An automation agent such as EMMA can carry out recurring tasks such as data capture, sending, and follow-up. Human oversight remains in place: the AI makes suggestions, and your team reviews and approves them. Every step is logged with a complete audit trail. You define which actions run automatically and which require approval, based on criticality.

Intervalid, EMMA, and the other components in our ecosystem are a blueprint, not a requirement. Whether you use verinice, HiScout, or another established tool, the methodology can also work with your existing environment.

Conclusion: Keep Supplier Risks Under Control

Supplier management under NIS-2 is more than a compliance exercise. It makes dependencies visible, prioritizes risks, and sets binding expectations for business-critical service providers. The key takeaways:

• Classify by risk instead of treating every supplier the same: Three tiers and four screening questions provide a transparent foundation.
• The first pass is manageable: The methodology itself may take only a few hours. The real effort is in building the inventory–and that work already improves security.
• Contracts are the leverage point: A 24-hour notification clause for critical suppliers gives you response time and the information you need for your own BSI reporting.
• Tools and AI reduce manual work–the decisions remain yours.