This guide is for companies that fall under NIS2 themselves and assess their suppliers. If you answer questionnaires from customers, see our guide on security questionnaires.
What the law requires
| Source | Content | For whom |
|---|---|---|
| § 30(2) no. 4 BSIG | Supply chain security, including relationships with direct suppliers and service providers | Essential and important entities |
| § 30(1) sentence 3 BSIG | Compliance must be documented | The same |
| Art. 21(3) NIS2 | Take into account specific vulnerabilities of suppliers, overall product quality, cybersecurity practices, secure development | Instruction to Member States |
| Annex no. 5 of Implementing Regulation (EU) 2024/2690 | Policy, selection criteria, contract content, directory, review | Binding only for certain digital types of entity |
For all other entities the Implementing Regulation is not binding. It still works as orientation because it is very concrete. The law prescribes neither a questionnaire nor an audit method. You decide based on risk and proportionality (§ 30(1) BSIG).
Important for your suppliers: the duty rests first with your company. A supplier does not fall under the BSIG just because it supplies you. It becomes binding for them through the contract.
The assessment in six steps
- Record suppliers. Start with purchasing, accounting and IT: who delivers, who maintains, who has access?
- Classify. Give every supplier a criticality level. The criteria are in the next section.
- Ask. Choose scope and depth per level and set a deadline.
- Review. Compare answers with evidence. A "yes" without proof is only a statement.
- Act. Ask for more, agree measures or record a risk.
- Repeat. Set a rhythm per level and also review after events such as an incident.
Classifying suppliers
Not every supplier needs the same effort. The table is a proposal, not a requirement of the law.
| Level | Feature | Example | Scope | Rhythm |
|---|---|---|---|---|
| Critical | Remote access to plants, or an outage stops operations | Machine supplier with remote maintenance | Full questionnaire, evidence, contract review | Yearly |
| High | Access to sensitive data or important systems | IT service provider, cloud provider | Full questionnaire, evidence | Yearly |
| Medium | Limited access, replaceable | Software supplier without data access | Short questionnaire | Every two years |
| Low | No access, replaceable | Office supplies | No questionnaire, record only | On change |
Questionnaire template
The questions are our proposal. Ask only what you will evaluate. Decide in advance which evidence counts as proof for each question.
| Topic | Question | Possible evidence |
|---|---|---|
| Responsibility | Who is responsible for information security and reachable? | Named person, contact |
| Certificates | Which certificates exist, with what scope? | Certificate, Statement of Applicability |
| Access | How are accounts and rights for our systems handled? | Authorization concept |
| Multi-factor sign-in | Do all remote accesses use a second factor? | Policy, configuration extract |
| Vulnerabilities | How do you find and fix vulnerabilities? | Process description, patch report |
| Development | How do you secure the development of your products? | Description, SBOM, test report |
| Incidents | How quickly do you inform us about an incident? | Process, contract clause |
| Continuity | How do you restore the service after an outage? | Contingency plan, test record |
| Subcontractors | Who else delivers services for us? | List |
| End of contract | How do you return or delete data? | Contract clause |
What belongs in the contract
For digital types of entity, point 5.1.4 of the Implementing Regulation names concrete contract content, where appropriate. It works as orientation for others as well:
- Requirements: Cybersecurity requirements for suppliers and service providers.
- Staff: Awareness, qualification and training requirements for the supplier's staff, where appropriate including certifications.
- Background checks: Requirements on background checks of the supplier's staff.
- Incidents: Notification without undue delay of incidents that present a risk to you.
- Right to audit: A right to audit or to receive audit reports.
- Vulnerabilities: An obligation to fix vulnerabilities that present a risk to you.
- Subcontractors: Requirements on subcontracting.
- End of contract: Obligations on termination, such as retrieving and disposing of information.
Example from production
The example is invented. A food producer records 180 suppliers and classifies 14 as critical or high.
- Machine supplier: Remote maintenance without a second factor. Measure with a deadline, contract is extended.
- Cloud provider: Certificate available and the scope fits. Assessment without conditions.
- Small IT service provider: No certificates but traceable evidence. Assessment with one follow-up request.
Checklist
- The supplier list is complete and remote access is marked.
- Criteria for classification are set.
- Questionnaire and evidence match the level.
- Answers are reviewed, not just filed.
- Gaps lead to measures or risks.
- Contracts of critical suppliers are checked.
- A rhythm is set per level.
- Results are documented and feed into the report to management.
The assessment in Complass
No more questionnaires by email and traffic lights in a spreadsheet. In Complass the assessment sits on the supplier:
- Classification: Short questions on data, access and dependency lead to a proposal for criticality, questionnaire and review cycle.
- Self-assessment: You choose the building blocks, such as NIS2, ISO 27001 or IEC 62443-2-4, and set a deadline.
- Supplier account: The supplier answers in their own free account and uploads evidence.
- Review: Per answer you choose "In order" or "Request more". Closing fixes the assessment with a checksum.
- Follow-up: Gaps become measures with a deadline or risks in the supply chain category.
- Deadlines: Reassessment, expiry of evidence and contract end appear on the deadlines page.
- Reinvitation: If you wish, Complass invites the supplier again automatically 30 days before the follow-up date.
Frequently asked questions
Do we have to assess all suppliers?
The law sets no minimum number. It requires appropriate and proportionate measures. Record everyone and go deeper based on risk.
Is an ISO 27001 certificate enough?
It is strong evidence if the scope covers the service for you. So check the scope and the Statement of Applicability, not just the logo.
What if a supplier does not answer?
Send a reminder with a deadline and find out why. If no answer comes, assess the risk yourself and record the decision. In Complass you can also fill in the self-assessment on their behalf, for example after a conversation.
Does this also apply to indirect suppliers?
§ 30(2) no. 4 BSIG names direct suppliers and service providers. Ask them about their subcontractors instead of assessing every further party yourself.
How often do we reassess?
The law sets no interval. Set it by level and also review after incidents or major changes.
In a demo we use the demo company to show you how classification, self-assessment and review come together in Complass.
Request a demo Try it for 14 days
Read more
- Guide "Answering customer security questionnaires"
- Guide "Implementing NIS2: the step-by-step guide"
- Whitepaper on NIS2 in the supply chain
- Supplier management: self-assessment, evidence and review
- NIS2 and the BSIG in Complass: applicability, duties and implementation
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the BSIG and the requirements of the BSI are authoritative. As of November 2026.