Orbiq LogoOrbiq
NIS2 Supply Chain Security: Why Annual Vendor Assessments Are No Longer Enough
2026-02-22
By Anna Bley

NIS2 Supply Chain Security: Why Annual Vendor Assessments Are No Longer Enough

NIS2 Article 21(2)(d) requires continuous supply chain security – not point-in-time questionnaires. What's changing, why your ISMS hits its limits here, and how to build the operational layer that's actually required.

NIS2
Security
Compliance

NIS2 Supply Chain Security: Why Annual Vendor Assessments Are No Longer Enough

Vendor assessments are a standard part of every ISMS: questionnaire out, answers in, result documented, repeat next year. That was sufficient – until NIS2 turned "supply chain security" from a governance obligation into an operational requirement.

NIS2 doesn't require a vendor assessment. NIS2 requires supply chain control: ongoing monitoring, event-triggered re-assessments, and evidence about the security posture of your direct suppliers and service providers – available at all times.

Jump to:

The Problem in One Sentence

Most organizations have a vendor assessment process. Very few have vendor oversight. NIS2 requires the latter.

The difference sounds subtle but is fundamental: an assessment is a snapshot – a point-in-time view at a specific moment. Oversight is an ongoing process that detects when things change and responds accordingly. NIS2 was written precisely for this distinction.

What Article 21(2)(d) Actually Requires {#what-article-21-requires}

The NIS2 Directive states the supply chain requirement in Article 21(2)(d):

"supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers"

Article 21(3) adds that entities must take into account the specific vulnerabilities of each direct supplier and service provider, as well as the overall quality of products and cybersecurity practices – including the security of development procedures.

National implementations translate this into binding law. In Germany, § 30 BSIG anchors supply chain security as part of mandatory risk management measures. The BSI further recommends contractually obliging suppliers to comply with IT security standards and provide evidence of compliance.

Three things stand out:

First: It's about direct suppliers and service providers – not the entire chain, but each individual direct supplier specifically. Blanket assessments won't suffice.

Second: The requirement is dynamic. "Security-related aspects of the relationships" – not "one-time assessment at onboarding." The relationship is ongoing, so the security assessment must be ongoing too.

Third: The overall quality of cybersecurity practices must be considered. This means: not just checking whether a supplier has an ISO certification, but understanding how they actually operate – and whether that changes.

Why Annual Assessments Fall Short {#why-annual-assessments-fall-short}

The annual vendor assessment is the standard model in most ISMS implementations. It works roughly like this:

  1. Supplier is identified and categorized
  2. Questionnaire is sent out (often based on CAIQ, SIG, or custom templates)
  3. Responses are reviewed and evaluated
  4. Result is documented and filed
  5. Next year: repeat

This model has three structural weaknesses under NIS2:

The Time Lag

Between two annual assessments, a supplier's security posture can fundamentally change: a data breach, a leadership change in their CISO function, a shift in hosting infrastructure, a geopolitical reassessment. Twelve months is an eternity in cybersecurity. Assessing once a year means systematically working with outdated data.

The Self-Declaration

Questionnaires are self-declarations. They reflect what the supplier says about themselves – not what's actually the case. ENISA's implementation guidance explicitly notes that the quality of security practices must be evaluated, not just the existence of documentation.

The Missing Responsiveness

An annual cycle has no mechanism for event-driven reassessments. When a supplier experiences a security incident, when regulatory conditions change, when new vulnerabilities emerge – the next scheduled assessment may be months away. NIS2 expects responsiveness, not waiting.

What Continuous Vendor Assurance Looks Like in Practice {#continuous-vendor-assurance}

Continuous vendor oversight is not a permanent audit. It's a system that does four things simultaneously:

Ongoing Monitoring

Automated signals about changes in a supplier's security status – publicly available information, certification status, known vulnerabilities, media events, regulatory changes. Not as a replacement for deep assessments, but as an early warning system that detects when a deep assessment becomes necessary.

Event-Triggered Re-Assessments

When a monitoring signal indicates a change, a reassessment must be possible – without restarting the entire assessment process from scratch. This means: modular evaluations that address the affected areas specifically, rather than unrolling a complete questionnaire from the beginning.

Integrated Evidence

Results from monitoring and assessments must converge – in an overview that shows the current security status of each supplier, with metadata: When was the last assessment? On what basis? What has changed since? What open items remain? This evidence must be retrievable at all times – not assembled for the next audit.

Communication Interface

When the situation changes, communication with the supplier must be fast, structured, and documented. Not through email chains with attached PDFs, but through a defined channel that versions and records requests, responses, and evidence.

The Supply Chain as a Proof Obligation {#supply-chain-proof-obligation}

NIS2 doesn't just require organizations to control their supply chain – they must also be able to prove it. Article 21(2)(f) combined with expanded supervisory powers means: the effectiveness of supply chain measures must be demonstrable at any time.

In practice, this means: when authorities request information, an organization must be able to show which suppliers are classified as critical, on what basis the assessment was made, when the last review took place, what measures were derived from the assessment, what residual risks exist, and how they're being managed.

A folder of filed questionnaires won't suffice. What's needed is a living overview – current, versioned, traceable.

Where the ISMS Stops and Operational Systems Begin

An ISMS defines the process: suppliers are assessed, risks are captured, measures are documented. That's valuable and remains the foundation.

But the operational execution – ongoing monitoring, event-triggered re-assessments, integrated evidence management, and structured supplier communication – exceeds what an internal documentation structure can deliver.

CapabilityISMSOperational Vendor Assurance System
Supplier categorization and registry✅✅
Initial assessment (onboarding)✅✅
Annual re-assessments✅✅
Ongoing monitoring (signals, certificates, vulnerabilities)❌✅
Event-triggered modular re-assessments❌✅
Integrated evidence overview with metadata❌✅
Structured communication with suppliers❌✅
Evidence retrievable on demand for authorities❌✅

The ISMS remains the control instrument. But for operational supply chain security under NIS2, an additional layer is needed – one that doesn't document that something was done, but actually does it.

What Organizations Should Do Now

1. Review Your Supplier Registry Against NIS2 Requirements

Which suppliers are relevant to the delivery of your essential or important services? How granular is your categorization? Are the specific vulnerabilities of each direct supplier being considered – as Article 21(3) requires?

2. Rethink Your Assessment Model

Is the annual cycle truly sufficient – or are there suppliers whose risk profile requires more frequent or event-driven review? Is there a mechanism for trigger-based re-assessments?

3. Build Monitoring Capability

What signals could indicate a change in a supplier's security status? Which of these can be captured automatically? How are they evaluated and integrated into the assessment process?

4. Shift Evidence from Filing to Retrieval

Can you show an auditor today which suppliers are classified as critical, when the last assessment took place, and what open measures exist? If the answer is "I need to put that together," your evidence process isn't NIS2-ready.

5. Review Contractual Foundations

Do your contracts obligate suppliers to comply with security standards and provide evidence? Do they include clauses for incident notification, audit rights, and cooperation obligations during security incidents?

Sources

  1. Directive (EU) 2022/2555 (NIS2 Directive) – Full Text – Official Journal of the European Union. Article 21(2)(d) and 21(3) on supply chain security.
  2. BSI – NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG) – § 30 BSIG on risk management measures including supply chain security.
  3. ENISA – Implementing Guidance on NIS2 Security Measures – ENISA's implementation guidance, particularly on evaluating suppliers and service providers.
  4. ENISA – Good Practices for Supply Chain Cybersecurity – Best practices for assessing and managing supply chain cybersecurity risks.
  5. DLA Piper – NIS2 Directive Explained: Supply Chain Security – Practice-oriented analysis of NIS2 supply chain requirements.
  6. BSI – #nis2know Info Package: Secure Supply Chain – BSI's information package on implementing supply chain security.

Related Reading