NIS2 Supplier Evidence Request Checklist (Free XLSX & PDF)

NIS2 Supplier Evidence Request Checklist: Free Template

A NIS2 supplier evidence request checklist is a structured register of the security evidence you request from each direct supplier and service provider — certifications, penetration test summaries, incident-notification SLAs, subcontractor disclosures, and business continuity test results — mapped to Directive (EU) 2022/2555 Article 21(2)(d) and Article 21(3). Each evidence row carries acceptable evidence types and a review cadence tied to the supplier's criticality tier, so your supply-chain oversight is demonstrable at any point an authority asks.

Most teams already run a NIS2 supplier questionnaire. What NIS2 actually tests is whether you can produce evidence: which suppliers are critical, what artefacts you hold for each, when they were last refreshed, and what happens when a supplier goes silent. This free template — available as XLSX, PDF, and a machine-readable Markdown file for AI agents — turns those questions into a working register. It is the operational companion to our guides on vendor assurance under NIS2 and NIS2 supply chain security, which explain why continuous oversight is required; this page gives you the artefact that does it.

Key Takeaways

• NIS2 Article 21(2)(d) makes supply-chain security a mandatory risk-management measure, covering the security-related aspects of relationships with each direct supplier and service provider — not the supplier base in aggregate.
• Article 21(3) tells you what to look at: the vulnerabilities specific to each direct supplier, the overall quality of their products and cybersecurity practices — explicitly including secure development procedures — and the results of coordinated risk assessments under Article 22(1).
• Evidence beats self-declaration. ENISA's supply-chain guidance calls for assessing the quality of suppliers' security practices, and its June 2025 technical implementation guidance names supplier vetting, contractual security clauses, and ongoing monitoring as core expectations.
• Cadence follows criticality. The template's three-tier rubric assigns each evidence category a refresh frequency per tier, plus event triggers — incident, subcontractor change, certificate expiry — that override the calendar.
• The stakes are concrete: essential entities face fines up to €10 million or 2% of worldwide annual turnover, important entities up to €7 million or 1.4%, and supervisory authorities can request supply-chain evidence at any time.

What's Inside the Template

The XLSX contains four sheets: a Supplier Register, the Evidence Checklist itself, a Criticality Rubric, and an Instructions sheet. The PDF mirrors the checklist for print and review meetings; the Markdown variant carries the full structure with YAML metadata so an AI agent can run an evidence request end to end.

The core of the template is the evidence checklist — in effect a NIS2 supply chain requirements checklist, row by row. Here is a preview of the actual rows:

Evidence category	What to request	Acceptable evidence types	Cadence (Tier 1 / 2 / 3)	NIS2 anchor
Certifications & independent assurance	Current certificate or attestation covering the service you buy	ISO 27001 certificate with scope + validity; SOC 2 Type II report (+ bridge letter if >12 months)	Annual + expiry alerts / Annual / Every 3 years	Art. 21(3) — quality of cybersecurity practices
Penetration testing	Most recent pentest executive summary	Summary with scope, methodology, findings severity, remediation status — not the full exploit report	Annual / Annual / Self-attestation	Art. 21(2)(e), (f)
Vulnerability & patch management	Patching SLAs and time-to-patch metrics	Vulnerability management policy; metrics for critical CVEs over the last 6–12 months	Quarterly metrics / Annual / Onboarding	Art. 21(2)(e)
Secure development	SDLC security practices for software suppliers	Secure development policy; SAST/DAST evidence; SBOM for critical software	Annual / Annual / n/a	Art. 21(3) — secure development procedures
Incident notification SLA	Contractual commitment to notify you of incidents affecting your service	Signed clause with notification window (hours), named contacts, escalation path	Verify at onboarding + annually / Annual / Contract review	Art. 21(2)(b); feeds your Art. 23 timeline
Subcontractor disclosure	Current subcontractor/subprocessor register + change-notification commitment	Register with entities, locations, services; flow-down security clause evidence	Quarterly or on change / Annual / Onboarding	Art. 21(2)(d)
Business continuity & DR	BCP/DR covering your service, with RTO/RPO and test evidence	Plan extract; most recent test report with date, scenario, corrective actions	Annual test evidence / Annual confirmation / Attestation	Art. 21(2)(c)
Access control & encryption	IAM and cryptography posture for systems touching your data	MFA/PAM policy; sample access review; encryption standards in transit and at rest	Annual / Annual / Attestation	Art. 21(2)(i), (j)

Each row in the XLSX also carries workflow fields — date requested, date received, status, reviewer — so the register doubles as your audit trail.

How to Use It: Tiering, Cadence, Escalation

Step 1 — Tier every supplier. The Criticality Rubric scores each direct supplier on three dimensions: service dependency (would an outage disrupt your essential or important service?), access (production systems, sensitive data, network connectivity), and substitutability. Tier 1 suppliers get the full evidence set; Tier 2 a core set; Tier 3 a lightweight attestation. This is how you honour Article 21(3)'s "vulnerabilities specific to each direct supplier" without drowning in paperwork — proportionality is built into the directive's "appropriate and proportionate" standard.

Step 2 — Run the evidence cadence. Each checklist row states its refresh frequency per tier. Calendar cadence is the floor, not the ceiling: event triggers — a supplier incident, a new subcontractor, an expiring certificate, a change in service scope — override the schedule and prompt an immediate re-request for the affected categories only. That event-driven pattern is exactly what separates vendor oversight from point-in-time assessment.

Step 3 — Escalate on silence. The template ships with a four-stage escalation workflow: reminder at 10 business days, escalation to the commercial owner at 20, formal notice invoking the contract's audit/evidence clause at 30, and a documented risk decision — acceptance, compensating controls, or termination review — at 45. Every stage is logged, because an escalation trail is itself evidence that your oversight operates. Authorities supervising essential and important entities can require proof of Article 21 measures at any time, and auditors increasingly ask for exactly this kind of documentation.

Legal Basis

The checklist is anchored in Directive (EU) 2022/2555 (NIS2), in force since 16 January 2023 with a transposition deadline of 17 October 2024. Article 21(2)(d) lists "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" among the minimum risk-management measures. Article 21(3) requires entities to take into account the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices — including their secure development procedures — and the results of coordinated security risk assessments of critical supply chains under Article 22(1).

The incident-notification SLA row ties into Article 23, which obliges you to file an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. You cannot meet those windows if a supplier incident reaches you late — which is why the supplier's notification clause is an evidence item, not a nice-to-have. Our guide to Articles 21 and 23 together covers this dependency in depth.

For digital-infrastructure and ICT-service entities, Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 specifies the technical and methodological requirements, and ENISA's Technical Implementation Guidance (June 2025) details supplier vetting, contractual clauses, and ongoing monitoring as implementation expectations. ENISA's earlier Good Practices for Supply Chain Cybersecurity (June 2023) recommends maintaining a documented supplier list, defining risk criteria per supplier type, and periodically reviewing suppliers' ability to meet security requirements — the template's register and rubric implement those practices directly. Transposition is still uneven — the Commission escalated infringement proceedings to reasoned opinions against 19 member states in May 2025, and by mid-2026 most but not all member states have national laws in force (Germany's NIS2UmsuCG, for instance, took effect on 6 December 2025). Your obligations bind once your member state's law applies — but your suppliers' customers are asking now. See the NIS2 directive overview for the full transposition picture.

Beyond the EU: UK and Norway

The same checklist logic extends across the European map. The UK is replacing its NIS 2018 regulations through the Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025 and before the House of Lords as of mid-2026, with Royal Assent expected late 2026. It brings managed service providers, eligible data centres, and regulator-designated "critical suppliers" into direct scope, with 24-hour initial and 72-hour full incident reporting — so UK suppliers should expect evidence requests of exactly this shape. Norway applies the original NIS Directive through the digitalsikkerhetsloven, in force since 1 October 2025 and supervised by NSM (which also runs the national CSIRT), while NIS2 awaits incorporation into the EEA Agreement. If your supplier base spans the EU, UK, and EEA, one evidence register with jurisdiction-aware notes — as this template provides — beats three parallel spreadsheets.

From Checklist to Continuous Assurance

A spreadsheet proves you have a process; it cannot chase suppliers, re-score responses, or alert you when a certificate lapses. When the register outgrows manual upkeep, Orbiq's vendor assurance platform runs the same tiering, evidence collection, and escalation workflow continuously — with AI-evaluated responses and an audit trail generated as a by-product of the work.

---

Sources & References

1. Directive (EU) 2022/2555 (NIS2) — full text — Articles 21(2)(d), 21(3), 22, 23, and 34.
2. Commission Implementing Regulation (EU) 2024/2690 — technical and methodological requirements for digital-infrastructure entities.
3. ENISA — Technical Implementation Guidance on Cybersecurity Risk Management Measures — June 2025, version 1.0.
4. ENISA — Good Practices for Supply Chain Cybersecurity — June 2023.
5. European Commission — NIS2 Directive policy page — transposition status and infringement actions.
6. UK Government — Cyber Security and Resilience Bill collection — bill documents and factsheets.
7. NSM — Norwegian National Cyber Security Centre — Norway's national CSIRT and supervisory context.

Related Reading

• Vendor Assurance Under NIS2: What Article 21 Requires
• NIS2 Supply Chain Security: Requirements, Gaps, and How to Comply
• NIS2 Compliance Checklist: Complete Article 21 Requirements
• NIS2 Third-Party Risk Documentation: What Auditors Want to See
• NIS2 Articles 21 and 23: Incident Reporting and Supply Chain Security