NIS2 Supply-Chain Checks: What UK Suppliers Should Prepare For

NIS2 is an EU cyber security law, but its practical effect will not stop at the EU border. UK businesses that supply software, IT services, connected products, industrial systems, cloud services, logistics support, manufacturing components or specialist operational services to EU customers may increasingly be asked to prove how they manage cyber risk.

That does not mean every small UK supplier is automatically regulated by NIS2. For many firms, the more likely route is contractual rather than direct legal scope: a larger customer is in scope, that customer has to manage supply-chain cyber risk, and the supplier is asked for evidence before renewal, onboarding or a major project.

The sensible response is not to panic or buy a heavy compliance platform on day one. It is to understand what customers are likely to ask, prepare proportionate answers, and close the most obvious gaps before a questionnaire lands in somebody’s inbox with a short deadline.

Why NIS2 Matters Outside The Obvious Regulated Sectors

The European Commission’s NIS2 Directive FAQ explains that NIS2 expands the scope of the previous EU network and information systems rules. It covers essential and important entities across sectors including energy, transport, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space, postal and courier services, waste management, chemicals, food, some manufacturing, digital providers and research organisations.

For Bloom’s audience, the supply-chain part is the important bit. NIS2 requires in-scope organisations to address cyber security risks in their supply chains and supplier relationships. The Commission also says NIS2 includes core risk-management elements such as incident handling, supply-chain security, vulnerability handling and disclosure, cryptography and encryption where appropriate.

That creates a ripple effect. A UK firm may be outside direct NIS2 scope, but still supply an in-scope customer. Examples include:

• a software company selling a workflow tool to a manufacturer or logistics business;
• a web or integration partner maintaining a customer portal, API or e-commerce platform;
• a managed IT provider supporting remote access, backups, identity, devices or cloud services;
• an industrial supplier providing connected monitoring, machine data, diagnostics or reporting;
• a specialist manufacturer supplying parts into a regulated customer with tight operational dependencies;
• an ERP partner building extensions, reports, middleware or shop-floor integrations.

In those relationships, cyber security becomes part of supplier management. The customer may need to show that it has considered the risks created by suppliers, not simply that its own internal systems are well configured.

What Has Changed Recently?

NIS2 is not brand new, but the implementation detail is becoming more operational. The ENISA technical implementation guidance, published in June 2025, gives practical advice, examples of evidence and mappings for organisations implementing the EU-level requirements for several digital infrastructure, ICT service management and digital provider sectors. It sits alongside Commission Implementing Regulation (EU) 2024/2690, which sets more detailed cyber security risk-management requirements for those relevant entities.

In 2026, the EU’s NIS Cooperation Group also adopted an ICT supply-chain security toolbox. That matters because it points to a wider policy direction: organisations are being pushed to understand supplier dependencies, assess risk, build contractual expectations and manage concentration risk rather than treating cyber security as a one-off technical control.

The exact obligations still depend on the relevant Member State, the sector, the organisation’s size, the service provided and the final local implementation. UK businesses should not assume that a generic online checklist is legal advice. But commercially, the direction is clear enough: larger and regulated customers will ask more structured questions of suppliers.

The Questions Suppliers Are Likely To Face

NIS2 does not require every customer to send the same questionnaire, so the wording will vary. The substance is more predictable. A supplier may be asked to explain:

• what service, system or data flow it provides to the customer;
• which subcontractors, cloud services, software libraries or hosting providers support that service;
• who can access customer systems or data, and how that access is approved and removed;
• whether multi-factor authentication is used for administrative and remote access;
• how vulnerabilities are found, prioritised, fixed and communicated;
• how backups, recovery and business continuity are tested;
• how incidents are detected, escalated and reported to the customer;
• whether there are relevant certifications, policies, penetration test summaries or assurance reports;
• how changes, updates and deployments are controlled;
• what happens when support ends or the service is terminated.

This can feel excessive to a small supplier, especially when the actual service is narrow. The useful approach is to answer proportionately. A supplier that only provides public brochure content should not need the same assurance pack as a supplier with administrator access to production systems. But even a small supplier should know what it touches, who can access it, and how it would respond if something went wrong.

How Buyers Should Approach This

If you are the buyer, the mistake is to treat NIS2 as a reason to send the same long questionnaire to every supplier. That produces weak answers, creates friction, and often hides the suppliers that actually matter.

The UK National Cyber Security Centre’s guidance on mapping your supply chain is a useful starting point because it focuses on understanding supplier dependencies before imposing controls. It recommends building an up-to-date view of suppliers, what they provide, how important those services are, what information flows between organisations, what assurance has been completed, and when further assessment is due.

For a small or medium-sized business, that can start with a simple tiering exercise:

1. Critical suppliers: services that could stop trading, production, payments, customer access, regulatory reporting or core operations if they failed.
2. Data-sensitive suppliers: services that process customer data, employee data, commercially sensitive files, credentials, operational data or intellectual property.
3. Privileged-access suppliers: providers with administrator access, remote access, deployment rights, API keys or support access into important systems.
4. Low-risk suppliers: services with no meaningful access to important systems, data or operations.

Once suppliers are tiered, assurance can be matched to risk. A critical managed service provider may need stronger contractual clauses, incident notification commitments, evidence of access controls and backup testing. A low-risk supplier may only need basic due diligence and a named contact.

How Suppliers Can Prepare Without Overbuilding

For suppliers, the goal is to be ready to answer reasonable questions without scrambling. A practical first version could be a short supplier assurance pack, kept accurate and reviewed every few months.

Useful contents include:

• a plain-English description of the service you provide and the data or systems involved;
• a list of important subcontractors, hosting providers and software platforms used to deliver the service;
• a summary of access controls, including MFA, admin access, joiner-mover-leaver processes and remote access rules;
• your patching and vulnerability handling process;
• your backup, recovery and business continuity approach;
• your incident contact route and target notification process for affected customers;
• any relevant certifications, such as Cyber Essentials, ISO 27001 or sector-specific assurance where appropriate;
• support, maintenance and end-of-service terms;
• a short list of known exclusions or customer responsibilities.

The NCSC’s guide on how to assess and gain confidence in supply-chain cyber security is written mainly for medium and large organisations, but the structure is still useful for smaller firms. It encourages organisations to understand supplier relationships, embed cyber security controls through the contract, monitor supplier security performance and improve the approach over time.

Suppliers can use the same logic in reverse: make it easy for a sensible customer to understand your controls, your boundaries and your escalation route.

Do Not Claim More Than You Can Prove

There is a temptation to answer supplier questionnaires with whatever sounds reassuring. That is risky. If a customer asks whether backups are tested, do not say yes unless somebody can point to test dates, results and ownership. If a policy exists but nobody follows it, it is not good evidence. If a subcontractor runs part of the service, do not hide that dependency.

Good assurance is specific. Instead of saying “we follow industry best practice”, say which controls are in place, how often they are reviewed, and who owns them. If something is in progress, say so. A credible answer with a date and owner is usually better than an inflated answer that falls apart under follow-up.

Where This Connects With Websites, Software And Industrial Systems

For websites and digital services, NIS2-style supplier questions often land around hosting, CMS maintenance, plugin updates, administrator accounts, forms, payment journeys, backups, DNS, email authentication, analytics scripts and third-party integrations. These are ordinary website maintenance issues, but they become supply-chain issues when the site is customer-facing or connected to operational systems.

For software and SaaS suppliers, the emphasis is likely to be on secure development, dependency management, deployment controls, vulnerability disclosure, support lifetime and customer notification. This overlaps with the UK’s Software Security Code of Practice, but the NIS2 angle is usually customer assurance: can the buyer show that it understands and manages the supplier risk?

For manufacturing and industrial businesses, the key issue is operational dependency. A small piece of software, remote support route, sensor platform or reporting integration can become critical if production, maintenance, quality, logistics or customer commitments depend on it. Supplier assurance should therefore include operational impact, not just personal data.

A Sensible First Month Of Work

If this affects your business, a useful first month is small and practical:

1. List the customers, sectors and countries where NIS2-related questions are most likely to appear.
2. Map the systems, data, access and subcontractors involved in those customer relationships.
3. Write a one-page supplier assurance summary covering access, vulnerabilities, incidents, backups and support.
4. Check whether MFA, account offboarding, patching and backup testing are actually working.
5. Create a clear customer incident contact route and keep it somewhere your team can find quickly.
6. Review standard contracts and proposals so responsibilities are not vague.
7. Keep evidence lightweight but real: screenshots, logs, policy dates, test records and named owners.

That will not make every NIS2 question disappear, and it is not a substitute for legal advice where direct scope is uncertain. But it will put most small suppliers in a better position than waiting until a major customer asks for evidence at renewal.

The Bottom Line

NIS2 is another sign that cyber security is moving into normal supplier management. For UK small businesses, the direct legal position may vary, but the commercial expectation is easier to see: customers will want clearer answers about systems, access, vulnerabilities, incidents, subcontractors and continuity.

The best response is proportionate preparation. Know what you provide, know what you depend on, tighten the basics, and keep evidence that a customer can understand. That is useful whether the question comes from NIS2, a larger customer’s procurement process, a cyber insurance renewal or a sensible buyer who wants to avoid avoidable disruption.