Supply chain security under NIS2: assess and steer your service providers

If you are a supplier yourself and your customer asks for NIS2 evidence, read the page NIS2 for suppliers. All ten measures in Section 30(2) of the German BSI Act (BSIG), which transposes Article 21 of the NIS2 Directive (EU) 2022/2555 for essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen), are summarised on the Section 30 BSIG page. Legal status: BSIG as amended on 22 October 2026; general information, not legal advice.

What does Section 30(2) no. 4 BSIG require?

The act lists as a minimum measure the “security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers” (Section 30(2) sentence 2 no. 4, our translation). In Article 21(2)(d), the NIS2 Directive speaks of the relationships “between each entity and its direct suppliers or service providers”. The supply chain page of the BSI, the Federal Office for Information Security, quotes the wording of the directive; for entities in Germany, the text of the BSIG applies.

The duty puts into concrete terms the basic duty in Section 30(1): appropriate, proportionate and effective measures whose compliance must be documented. It has applied since 6 December 2025, whether or not the entity has registered with the BSI.

How should the duty be interpreted?

Three points determine the scope:

• Direct suppliers: this means the immediate suppliers and service providers. The entity reaches their subcontractors through contract clauses that are passed on.
• Vulnerabilities and development processes: the directive expressly requires entities to take into account the vulnerabilities specific to each supplier, the overall quality of their products and their cybersecurity practices, including their secure development procedures (Article 21(3)). The BSIG text does not say this, but the explanatory memorandum quoted by the BSI does: contractual agreements on risk management measures, handling of security incidents and patch management, and taking BSI recommendations on products and services into account.
• Who is obliged: the BSIG does not oblige suppliers directly. In the BSI’s view, however, the entity in scope must oblige them to meet corresponding security requirements in order to fulfil its own duties.

According to the BSI, there is no general certificate that proves the supply chain requirement is met. The BSI welcomes industry initiatives for a uniform catalogue of supplier questions. It names its CyberRisikoCheck as an initial assessment; NIS2 compliance cannot be achieved with it.

What does Implementing Regulation (EU) 2024/2690 set out?

For the eleven digital entity types for which the Implementing Regulation takes precedence under Section 30(3) BSIG (such as cloud providers, data centres and managed service providers; listed in full in the sector directory), chapter 5 of its annex regulates the supply chain in detail. For all other entities it is voluntary and a good template; the provider assessment below follows it.

Which ISO 27001 controls correspond to no. 4?

The BSI maps the supply chain security policy to controls A.5.19, A.5.20, A.5.21 and A.8.30 of ISO/IEC 27001:2022, and the supplier register to A.5.22. The BSI stresses that implementing these standards does not automatically meet all BSIG requirements.

If you work with IT-Grundschutz, the classification of Grundschutz++ is on the sister site NIS2 and Grundschutz++ on grundschutz-readiness.de (German). The comparison of ISO 27001 and NIS2 as a whole is on the page NIS2 and ISO 27001.

Do we need an SBOM from our suppliers?

The BSIG, the NIS2 Directive and the Implementing Regulation do not use the term SBOM (software bill of materials). A general duty to require an SBOM from every supplier cannot be derived from them.

The texts do require information for which an SBOM is a suitable format: the directive requires supplier vulnerabilities and the quality of their products to be taken into account. For its entity types, the Implementing Regulation requires, when acquiring ICT products, “information describing the hardware and software components” and details on security updates over the lifetime (Annex point 6.1.2(b) and (c)). An SBOM provides exactly this list of components in machine-readable form and shows whether a newly disclosed vulnerability affects a product in use.

Our recommendation: for critical software (rating A), ask in the questionnaire whether the supplier is willing to provide an SBOM, and include it in the requirements for new purchases; for standard software without special access, in our view it is enough to ask about update deadlines and the support period. Which duties manufacturers have under the CRA (Regulation (EU) 2024/2847) and how this relates to NIS2 is explained on the sister site CRA, NIS2 and DORA compared on cra-readiness.de. Blackfort Technology offers creating and analysing SBOMs as a separate service: SBOM service.

Which evidence is suitable?

There is no prescribed evidence package, and evidence is only due when the BSI orders it. Suitable evidence examples, by origin:

Example: a waste management company with eight service providers

Fictitious example, not a client. A waste management company with 140 employees falls under Annex 2 (waste management) and is an important entity. An IT service company runs servers and firewall, the industry software runs as a cloud service, the vehicles report their routes to a telematics platform, and the manufacturer maintains the weighbridge via remote access. On top of that come payroll, a printer service, building cleaning and a workwear supplier.

The company creates a register, rates each provider by access and importance and only sends questionnaires to the critical ones.

Work product 1: service provider assessment

Rating: A = access to systems or data and high importance for the entity’s own services; B = one of the two; C = neither. A gets the full questionnaire with evidence and is reviewed annually, B the core questions every two years, C no questionnaire.

The result: four A-rated providers; three lack contract clauses and two lack technical minimum standards. Remote maintenance of the weighbridge is the largest open risk. How to secure remote access by service providers technically is described by Blackfort Technology on the page secure remote access. The open points go into the risk analysis as risks.

Work product 2: supplier questionnaire

The questionnaire contains 27 questions in twelve areas, 12 of them core questions for rating B. Each question names its reference to Section 30(2) BSIG, the directive or the annex of the Implementing Regulation. The Excel file has a cover sheet with instructions, a sheet for the supplier’s details, the questionnaire with drop-down fields and an assessment sheet for the customer. The file is available in German only.

Download the German-language questionnaire (Excel, version 1.1, as of 6 November 2026)

You may use and adapt this template within your own company and pass it on to your suppliers and service providers. Publishing or reselling it is not permitted.

Excerpt (core questions, translated):

The questionnaire is a working aid and does not replace contractual provisions. Answers without evidence are self-declarations; for rating A you should ask for proof, such as a certificate with its scope, a test record or a policy. An ISO 27001 certificate is good evidence if the service you receive is within its scope; it does not replace contract clauses such as the reporting duty. How suppliers use certificates as evidence is shown on the page NIS2 for suppliers.

Three typical gaps

How Blackfort Technology helps

We set up the provider register with you, rate the providers, evaluate the questionnaires and draft the technical requirements for contract amendments. The legal drafting of the contracts stays with your legal counsel. The starting point is the NIS2 gap analysis.