Your security perimeter includes your suppliers
NIS2 requires organisations to consider vulnerabilities specific to direct suppliers and service providers, including the quality of their cybersecurity practices and secure development procedures.
◇
Prioritise
Tier suppliers by service criticality, access, data, concentration, and substitutability.
▤
Contract
Define security, notification, audit, recovery, and exit obligations.
◉
Monitor
Track assurance, exposures, incidents, changes, and remediation.
A lifecycle, not a questionnaire
- 01 Discover dependencies Connect vendors to critical processes, assets, and data flows.
- 02 Assess proportionately Request evidence that matches the risk and service relationship.
- 03 Control through contract Set measurable obligations, escalation paths, and reporting windows.
- 04 Exercise failure scenarios Test continuity, substitution, recovery, and coordinated response.