NIS2 Article 21(2)(d) requires supply chain security, including relationships with direct suppliers. Commission Implementing Regulation 2024/2690 shows what that can mean in a contract: incident notification duties, audit rights, vulnerability handling, subcontracting rules and exit terms. This checklist adapts those points for any buyer or vendor.
Why contracts carry the weight
Article 21(3) says entities must consider the vulnerabilities specific to each direct supplier and the overall quality of products and cybersecurity practices, including secure development procedures. A contract is where those findings turn into enforceable terms. The implementing regulation applies directly to a defined set of digital entities, but it is a good template for everyone else.
The clause list
Point 5.1.4 of the annex to Regulation 2024/2690 says contracts should specify, where appropriate:
- Cybersecurity requirements for the supplier, including those for acquiring ICT products and services.
- Awareness, skills and training, and certifications where relevant, for the supplier's staff.
- Background verification of supplier employees.
- Incident notification: an obligation to tell you without undue delay about incidents that present a risk to your systems.
- Audit rights, or the right to receive audit reports.
- Vulnerability handling: an obligation to handle vulnerabilities that threaten your systems.
- Subcontracting: requirements and flow down of the same security requirements to subcontractors.
- Termination duties: retrieval and disposal of information the supplier holds.
Add commercial detail to each: how fast is "without undue delay" in hours, who gets the notice, and what format the audit report takes.
Selection criteria before the contract
Point 5.1.2 lists selection criteria: the supplier's cybersecurity practices including secure development, ability to meet your specifications, product quality and resilience, and your ability to diversify sources and limit vendor lock-in. Score suppliers on these before you sign.
A supplier directory
Point 5.2 asks for an up to date registry of direct suppliers with contact points and the ICT products, services and processes each provides. A spreadsheet works. Add a column for contract renewal date and last security review.
Keep monitoring after signing
Point 5.1.6 and 5.1.7 ask you to review the policy at planned intervals and after significant incidents, monitor service level reports, review incidents tied to supplier products, and analyse the risk of supplier changes. Put a yearly review in the calendar for each critical supplier.
For vendors on the receiving end
If you sell to regulated customers, expect these clauses. Prepare standard answers: your incident notification window, how you handle vulnerabilities, your subcontractor list and a current SBOM. Having them ready shortens negotiations.
Safeguard's SBOM and dependency scanning, compliance and evidence automation, and policy features can help produce the data behind these answers.
Quick check
Must every supplier contract include every clause?
No. The annex says "where appropriate" and ties the choice to the risk assessment. Document why you left a clause out.
Does NIS2 cover only direct suppliers?
Article 21(2)(d) refers to direct suppliers and service providers. Subcontractor requirements can be flowed down through the contract.
Sources
Last reviewed: 19 October 2026.
