NIS2 enforcement is active across the EU. National competent authorities are conducting Article 21 reviews — and supply chain risk documentation is the first thing they ask for. This guide explains what compliance means in practice, who it affects, and how to build a defensible programme without a GRC consultant or a €50k tool.
NIS2 creates two categories of organisations that need to take vendor compliance seriously — those directly in scope and those indirectly affected through their customers’ requirements.
Energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, ICT service management, public administration, and more. Medium (50+ employees / €10m+ turnover) and large organisations in these sectors must comply with Article 21 in full.
Direct obligationCloud computing services, online marketplaces, online search engines, and social networking platforms above size thresholds. ICT managed service providers are explicitly included — if you provide outsourced IT to regulated businesses, NIS2 applies to you directly, not just via your clients.
Direct obligationIf your customers include banks, energy companies, healthcare providers, or any other NIS2-regulated entity, their Article 21(2)(d) obligation flows directly to you via vendor questionnaires and contract requirements. You do not need to be in scope yourself to face NIS2 vendor compliance demands from enterprise customers.
Supply chain pressureArticle 21(2)(d) is deliberately broad — it requires “supply chain security.” National competent authorities have clarified what this means in practice across five areas.
A full inventory of all suppliers and ICT service providers, classified by criticality to your operations. Not a one-time exercise — auditors verify the register is current and reflects recent vendor changes. Critical vendors (those whose failure would significantly disrupt your operations) require the most rigorous documentation.
VendorAuditly: live vendor register with risk tiers and auto-scoringRisk assessments must be documented, dated, and proportionate to each vendor’s criticality. Auditors look for evidence of methodology — how you determined the risk tier, what criteria you applied, and when you last reviewed it. An undated spreadsheet cell saying “medium risk” does not satisfy this requirement.
VendorAuditly: risk scores with full audit trail, methodology, and review datesEvidence that you have assessed each critical vendor’s security posture directly — through questionnaires, self-assessments, or third-party audit reports. Auditors want to see: when questionnaires were sent, whether they were chased for non-response, what the responses contain, and how gaps were addressed. The send timestamp and chase log matter as much as the responses themselves.
VendorAuditly: NIS2 questionnaire templates, auto-chase, response tracking with timestampsContracts with critical vendors must include security obligations: breach notification timelines (NIS2 requires 24/72-hour notification chains), audit rights, data processing terms, and incident cooperation requirements. Auditors may request contract clauses for critical vendors — missing clauses are a finding requiring remediation.
VendorAuditly: AI contract clause checker flags missing NIS2 obligations automaticallyNIS2 requires ongoing monitoring — not a once-a-year audit. Evidence of continuous oversight includes: certificate expiry tracking with alerts, breach monitoring, reassessment records after vendor incidents, and a programme that updates when vendors change their security posture. A programme last reviewed 14 months ago is a compliance gap regardless of what it contained.
VendorAuditly: continuous monitoring, expiry alerts, breach watchlist, live risk scoresThree approaches exist. Each has different costs, limitations, and outcomes when a regulator asks for evidence. Here is an honest comparison.
| Requirement | Spreadsheet | GRC consultant | VendorAuditly ($49/mo) |
|---|---|---|---|
| Vendor register | ∼ Manual, no structure | ∼ Built once, not maintained | ✓ Live, risk-tiered, searchable |
| Dated risk assessments | ✗ No audit trail or timestamps | ∼ Point-in-time only | ✓ Auto-timestamped, full history |
| Questionnaire tracking | ✗ Email threads, no evidence log | ∼ Manual, billed by hour | ✓ Sent, chased, logged automatically |
| Certificate expiry alerts | ✗ Manual calendar reminders | ✗ Not included | ✓ Automated alerts, AI extraction |
| Contract clause checks | ✗ Not possible | ∼ Manual, expensive | ✓ AI flags missing NIS2 clauses |
| Continuous monitoring | ✗ Static, not live | ✗ Annual engagement only | ✓ Weekly scans, breach watchlist |
| Regulator-ready evidence pack | ✗ Not exportable in standard format | ∼ Custom report, weeks turnaround | ✓ One-click NIS2 Article 21 PDF |
| Annual cost | Staff time (40–80 hrs/year) | €5,000–€20,000+ | $588/year ($49/month) |
Most organisations can build a defensible Article 21 programme in two weeks. The key is starting with the vendor register and working outward — not trying to do everything at once.
Import your full supplier list. Classify each vendor as critical, high, medium, or low based on: data access, operational dependency, and potential disruption impact. This is the foundation — everything else is built on it.
Send Article 21-aligned security questionnaires to your top critical vendors immediately. The send timestamp creates your evidence — even partial responses are better than no documented assessment.
Upload insurance certificates, ISO 27001 certs, and SOC 2 reports from critical vendors. Run AI contract analysis on top-5 vendor contracts to identify missing NIS2 Article 21 clauses — audit rights, breach notification, data location.
Generate your NIS2 Article 21 evidence pack — a regulator-formatted PDF containing everything an auditor will ask for. Schedule quarterly re-assessments to keep the programme live, not point-in-time.
Import your vendor list, send NIS2 questionnaires, and export a regulator-ready evidence pack — all in under 10 minutes. No GRC consultant. No enterprise contract.
Free forever on 3 vendors · NIS2 evidence pack included · $49/month for full programme