NIS2 — Securing the Supply Chain
Obligation under Art. 21(2)(d) NIS2 to assess supply chain risks.
Definition
NIS2 requires essential and important entities to systematically assess and address cybersecurity risks in the supply chain. In practice: supplier classification, contractual obligations (e.g. incident notification), audits of critical suppliers. Typical documents: supplier security policy plus contractual clauses.
National implementation: Germany and Austria
NIS2 is an EU directive (NIS2 Directive (Directive (EU) 2022/2555)) and does not apply directly, but through the national implementing acts. Supply chain security under Art. 21(2)(d) NIS2 is an integral part of the statutory minimum catalogue of risk-management measures in both Germany and Austria. The wording is almost identical, but the competent authority differs.
Germany
Section 30 BSIG (German BSI Act (BSIG) 2025) requires particularly important entities and important entities to take appropriate, proportionate and effective technical and organisational measures. The minimum catalogue in § 30(2) expressly names, in no. 4, the "security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers". Competent authority: Federal Office for Information Security (BSI).
Austria
§ 32 of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (BGBl. I Nr. 94/2025) requires essential and important entities to take risk-management measures based on an all-hazards approach. The minimum catalogue in § 32(4) names, in (d), the "security of the supply chain, including security-related aspects of the relationships between each entity and its direct suppliers or service providers". Competent authority: Cybersecurity Authority (Cybersicherheitsbehörde, Austria).