Supplier security under NIS2: a practical way to start

A large share of serious incidents does not start at the victim. It starts at a supplier: a managed IT provider whose remote access tool was compromised, a payroll service whose database leaked, an e-mail marketing platform whose account was taken over and used to phish your customers in your name. NIS2 takes this seriously. Article 21(2)(d) lists “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” among the measures every covered entity must take.

This guide is a way to start that is proportionate for a small or mid-sized company.

Step 1: list the suppliers that touch your systems or data

Not every supplier matters. The coffee machine company does not. Ask three questions of each:

Do they hold our data? Accounting, payroll, CRM, cloud storage, backup.
Can they reach our systems? Managed IT, remote support, hosting, website agency.
Do they act in our name? E-mail sending, newsletters, payment pages, the domain registrar and DNS provider.

A yes to any of them puts the supplier on the list. For most small companies the list has between ten and forty names.

Your DNS already tells you a good part of it. Your MX records name your mailbox provider, the include: entries of your SPF record name every service allowed to send mail for you, your name servers name your DNS provider, and the verification records in your domain name the tools you signed up for. Perimetry Cloud reads all of these from the audits of your domains and lists the services for you.

Step 2: rank them

Put each supplier in one of three groups:

Critical: if they are compromised or stop, you stop or your customers are harmed (mail, hosting, managed IT, payroll).
Important: a compromise would hurt but you could work around it.
Minor: everything else on the list.

Spend your effort on the critical group.

Step 3: check what you can see from outside

Before asking a supplier anything, look at what they show to everyone. A few public signals say a lot about how a company looks after its own security:

Does their domain publish an enforced DMARC policy, or can anyone send mail in their name?
Are their certificates valid, their websites served over modern TLS, their security headers set?
Do their servers expose services with known exploited vulnerabilities?
Do they publish a security.txt saying how to report a vulnerability? The security.txt checker reads it and says whether it is valid.

None of this proves they are secure, but a supplier that fails all of it is unlikely to be strong where you cannot see. These checks are passive: they only read what any visitor can read, so you need nobody’s permission.

Step 4: ask the critical ones

For critical suppliers, send a short questionnaire once a year. Keep it short; long questionnaires get copied answers. Ask about multi-factor authentication for their staff, backups and how often they are tested, how they will tell you about an incident and how fast, where your data is hosted, and whether they hold a certification (ISO 27001, SOC 2, or a national scheme). Pre-filling it with what you already saw from outside saves them time and makes the answers easier to check.

Step 5: write it into the contract

For new contracts with critical suppliers, add clauses on incident notification (a deadline that lets you meet your own 24-hour obligation), on subcontracting, and on what happens to your data at the end.

Step 6: keep watching

A supplier’s security changes. A yearly questionnaire misses the certificate that expired in March or the server that started exposing a database in June. Watching the public signals continuously, and being told when a supplier’s score drops, is what turns a list into supply chain security.

How Perimetry helps

The Suppliers page of Perimetry Cloud watches your suppliers’ domains every week with the public checks only, alerts you when one gets worse, and sends security questionnaires pre-filled with what it already sees. It also lists the services it found in your own DNS, so that you can follow each of them in one click. See also NIS2 for small and mid-sized companies.