NIS2 and supply chain: the clause works only if the supplier produces evidence

The signal and the facts that change the decision

NIS2 includes supply-chain security among risk-management measures and ENISA guidance makes the topic operational. A clause repeating maintain adequate security does not define alert, deadline, evidence, support, or exit.

The entity’s duty is not fully transferred to the supplier by contract. Criticality, dependency, concentration, and substitutability should influence clause depth.

Relevant subcontractors need visibility and compatible requirements along the chain. An audit right without data, format, frequency, or remedy may be impossible to exercise during an incident.

Decision, limits, and stop condition

Negotiate verifiable duties by service and criticality: notification, vulnerability, incident, subcontracting, evidence, testing, and termination.

An audit right without data, format, frequency, or remedy may be impossible to exercise during an incident.

Execution and proof of completion

Execution should start by classifying services and linking risk scenarios to contractual duties. Then, defining periodic evidence and events requiring immediate notification. Closure requires testing contact, artefact delivery, escalation, and exit with the supplier.

The contract sample demonstrates requirement, received evidence, performed test, gap, and remedy per critical supplier.

• classifying services and linking risk scenarios to contractual duties.
• defining periodic evidence and events requiring immediate notification.
• testing contact, artefact delivery, escalation, and exit with the supplier.
• The contract sample demonstrates requirement, received evidence, performed test, gap, and remedy per critical supplier.