Question 1

Does NIS2 impose obligations on my vendors?

Accepted Answer

NIS2 requires entities in scope to manage the risk in their supply chain, which means assessing and monitoring their critical vendors. The directive does not bind vendors outside its scope directly, but those requirements are passed down to them contractually.

Question 2

Do you have to assess every vendor?

Accepted Answer

No. Article 21 imposes a risk-based approach: effort must be proportionate to the criticality of the third party. What is expected at review is the justification of that proportionality, not a volume of assessments.

Question 3

What evidence does a NIS2 review expect on the supply chain?

Accepted Answer

An inventory of third parties with justified criticality, dated assessments with the evidence received, and a record of decisions taken: compensating measures, remediation plans with deadlines, or walking away from the vendor.

Question 4

How does CISAPP connect vendor assessment and NIS2?

Accepted Answer

Every vendor assessment campaign feeds the NIS2 framework directly: the answer received is tied to the relevant Article 21 measure, to the risk in the register and to the dependency map, with regulator-ready exports.

Question 5

What if a vendor refuses to answer the questionnaire?

Accepted Answer

The refusal is itself information to record. The options are to rely on alternative evidence (certification, audit report, Trust Center), to impose compensating measures, or to qualify the risk and have it formally accepted.

Question 6

Does a non-EU vendor change the obligations?

Accepted Answer

The obligations remain yours: the regulated entity must demonstrate control of its supply chain wherever the third party sits. A non-EU vendor does add data transfer questions under the GDPR.

Requirement	Expected artefact	Where it lives in CISAPP
Identify critical third parties	Inventory with justified criticality	Vendor record + dependency mapping
Assess proportionately	Dated questionnaires and evidence received	Assessment campaigns
Monitor over time	Scheduled reassessments, recurring scans	SecOps score, certificate alerts
Trace decisions	Compensating measures, remediation plans	Risk register
Report incidents	24 h / 72 h / final report timeline	Significant incident tracking

NIS2 Vendor Compliance: Mapping and Evidence

What does NIS2 require on vendors?

What to produce for a review

From vendor questionnaire to regulatory export

FAQ

Sources

Ready to take control of your third-party risk?