What is supply chain security?
Supply chain security covers every measure by which an entity controls the risks that reach its systems through suppliers and service providers. § 30(2) sentence 2 no. 4 BSIG, part of the German BSI Act, requires security of the supply chain. That includes the security-related aspects of relationships with direct suppliers or service providers. Article 21(2)(d) of Directive (EU) 2022/2555 is to the same effect.
How the duty fits with the other NIS2 obligations is set out in the NIS2 guide.
The wording names direct suppliers
§ 30(2) sentence 2 no. 4 BSIG names relationships with direct suppliers and service providers expressly, as part ("including") of supply chain security. It names no duty to examine every upstream supplier yourself. A critical subcontractor remains a risk all the same; it is captured through the subcontracting rules in the contract with the direct supplier.
Article 21(3) of the Directive reaches further. It names what to take into account when choosing the measures:
| Consideration | Provision |
|---|---|
| the vulnerabilities specific to each direct supplier and service provider | Art. 21(3), first sentence |
| the overall quality of suppliers' products and cybersecurity practices, including their secure development procedures | Art. 21(3), first sentence |
| the results of the coordinated security risk assessments of critical supply chains at Union level | Art. 21(3), second sentence, with Art. 22(1) |
The three considerations work as criteria for classifying a supplier and for the depth of its examination.
Three building blocks: register, criticality, contract
Supply chain security starts with three building blocks, each resting on the one before:
- Register. Record every supplier with the service procured, the type of access and the data processed. Include specialist applications and maintenance access that do not go through procurement.
- Criticality. Classify suppliers by extent of access, replaceability, contribution to your own services and the consequences of an outage. A provider with administrative access to production systems needs a different depth of examination from a supplier with no system connection.
- Contract. Write into the contract the security requirements, the duties to cooperate and to report security incidents, and the rules on subcontractors. Add audit and information rights and provisions for termination.
These measures belong to the catalogue of measures in § 30(2) BSIG. Under § 30(1) sentence 3 BSIG, the entity has to document that it complies.
The 24-hour deadline reaches into the contract
The entity's own reporting chain starts with the early initial notification. It is due within 24 hours of becoming aware of a significant security incident (§ 32(1) sentence 1 no. 1 BSIG). The later stages are set out in NIS2 incident reporting.
Where the incident originates at a service provider, the 24-hour stage depends on when that provider informs you. A contractual duty to inform within a short period, and a named contact on both sides, are therefore the precondition of your own ability to report.
Are suppliers covered by NIS2 themselves?
Not automatically. The statutory duties fall on the entity in scope; a supplier does not become subject to registration or reporting because its customer is. Whether a supplier is itself covered depends on its own activity and size under § 28 BSIG and Annexes 1 and 2.
The requirements reach suppliers through the contract with the entity in scope. A supplier that receives such a security annex should run three checks:
- Ask which duty a clause serves; a requirement traceable to § 30(2) sentence 2 no. 4 BSIG is negotiable in its detail but not in principle.
- Read the incident notification clause with particular care, because the customer's 24-hour deadline sits behind it.
- Check the scope of any certificate you offer before you submit it.
Audits look at the management cycle, not the questionnaire
In an audit, a completed questionnaire shows only that a question was asked, as the post on supply chain security as the overlooked obligation sets out. Whether supply chain security is managed shows only in the answers to four questions:
- Is the supplier register complete and current, and how can that be seen?
- On what criteria was criticality classified, and who decided?
- What consequence did a poor assessment have: a condition, a deadline, an escalation, or only filing?
- What was done with suppliers who could not meet a requirement?
For the last question, a documented, time-limited residual risk approved by the responsible function is a sound answer. A formally complete assessment with no consequence does not answer it.
How do you grade evidence by criticality?
Evidence is graded by the supplier's criticality, so that the depth of examination sits where the risk sits.
| Criticality | Evidence |
|---|---|
| low | standardised self-assessment |
| high | audit report or certificate whose scope covers the service procured |
| critical | in addition, your own examination on a contractual basis |
Certificates, audit reports and self-assessments are dated snapshots.
DORA and ISO 27001 govern suppliers in their own right
For financial entities, DORA governs ICT third-party risk separately, with the contractual requirements in Chapter V, Section I (Articles 28 to 30) of Regulation (EU) 2022/2554. Under § 28(6) no. 1 BSIG, § 30 BSIG does not apply to them.
An ISMS to ISO/IEC 27001 contains its own measures on supplier relationships in Annex A, on which the implementation of no. 4 can build. The catalogue in § 30(2) BSIG is not exhaustive: sentence 2 requires "at least" the measures it names.
Service providers as assets in Rizzqo
NIS2 is supported in Rizzqo; its catalogue is enabled when a customer needs it. Rizzqo models a service provider as a supporting asset in a supplier category and links it to the processes and information that depend on it. The requirements of the catalogues held appear on that asset by category, together with the named owner and the evidence.