Securing the NIS2 Supply Chain: Section 30(2) No. 4 BSIG in Practice

1. Why the supply chain is a NIS2 focus area

NIS2 responds to reality: in 2024, 42% of all serious cyber incidents originated from supply chain attacks (ENISA Threat Landscape 2025). Examples:

• SolarWinds (2020): 18,000 customers compromised via a software update
• 3CX (2023): voice software update carrying a trojan
• MOVEit (2023): file transfer tool, 60+ million records stolen
• XZ Utils (2024): Linux backdoor in an upstream library

The consequence: NIS2 turns supply chain security into an explicit duty. It does not appear as an annex to risk management, but as a measure area in its own right — number 4 of ten in § 30(2) BSIG. In audit and supervisory practice in 2026, this is precisely the area with the most frequent findings; the typical finding is missing cybersecurity clauses in standard contracts. When mapping against ISO 27001, the likelihood of a gap is also highest here (Annex A.15), whereas areas such as business continuity (A.17) or cryptography (A.10) are usually already covered in certified organisations. Holding an ISO 27001 certification therefore means around 70 to 80 per cent of the Section 30 requirements are already met — supply chain due diligence under § 30(2) no. 4 BSIG is one of the gaps that must be closed deliberately.

2. § 30(2) no. 4 BSIG (NIS2UmsuCG)

"Security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers" — § 30(2) no. 4 BSIG

The underlying EU provision is worded more fully: "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" — Art. 21(2)(d) of the NIS2 Directive (Directive (EU) 2022/2555). It is given concrete shape by BSI guidance 03/2026 and the ENISA Supply Chain Guidelines 2024.

Number 4 does not stand on its own. The benchmark comes from § 30(1) BSIG: the measures must be appropriate, proportionate and effective in order to avoid disruptions to the availability, integrity and confidentiality of IT systems and to keep the impact of security incidents small — and compliance with them must be documented. § 30(2) sentence 1 BSIG adds that the measures should reflect the state of the art, take the relevant European and international standards into account and be based on an all-hazards approach. For supplier management this means: the depth of review scales with the risk — not every supplier needs an on-site audit — and the classification itself must be documented, because otherwise proportionality cannot be evidenced. The other nine areas of § 30(2) BSIG are covered in the overview article on the 10 mandatory measures.

Austria: § 32(4)(d) NISG 2026

Entities in Austria are not governed by the BSIG but by the NISG 2026 (BGBl. I Nr. 94/2025); it was promulgated on 23 December 2025 and becomes applicable on 1 October 2026 pursuant to § 51(1) and (2) NISG 2026 — so it does not yet apply as at the date of this article. The supply chain duty is set out there in § 32(4)(d) NISG 2026 and is expressly worded in more detail: "security of the supply chain, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers, taking into account the specific vulnerabilities of each direct supplier and service provider, the overall quality of the products and the cybersecurity practices of their suppliers and service providers, including the security of their development processes". The Austrian wording thus names four assessment dimensions expressly: specific vulnerabilities, overall quality of the products, cybersecurity practice and the security of development processes. The supervisory body is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (Federal Office for Cybersecurity, directly subordinate to the Federal Minister of the Interior, seat in Vienna — § 3a(1) and (2), § 3b(3) NISG 2026), not the BSI; significant incidents must be reported to the competent CSIRT — 24 hours / 72 hours / one month under § 34(2) NISG 2026 — and registration takes place under § 29 NISG 2026 within three months of entry into force, that is, by the end of 2026. Sanction range: up to EUR 10 million or 2% of worldwide annual turnover (essential entities) and up to EUR 7 million or 1.4% (important entities), § 45(2) and (3) NISG 2026.

3. Who the supply chain duty applies to

The duty under § 30(2) no. 4 BSIG applies to particularly important entities and important entities — who falls into these categories is decided by § 28 BSIG through the combination of type of entity (Annex 1 or Annex 2) and size. Two points are regularly overlooked in practice: the size-based classification as a particularly important entity requires a type of entity under Annex 1; classification as an important entity applies to types under Annex 1 or Annex 2. And several types of entity are covered irrespective of size, including operators of critical installations, qualified trust service providers, top-level domain name registries, DNS service providers and certain providers of public telecommunications networks and services. For calculating headcount, annual turnover and balance sheet total, Recommendation 2003/361/EC applies, with the exception of Art. 3(4) of its Annex (§ 28(4) BSIG).

Practical consequence: your classification determines the sanction range (section 10), but not whether you have to exercise supply chain due diligence — the catalogue of measures in § 30(2) BSIG applies equally to both classes. So first check the type of entity under Annex 1 or 2, and only then the thresholds.

4. The 8-step supplier audit

Steps 1 and 2: inventory and criticality

Without a complete inventory, none of the other seven stages is robust — the inventory is the basis on which proportionality within the meaning of § 30(1) BSIG can be justified at all. Record every external service provider with access to systems, data or processes, not just the contractual partners of the IT department: maintenance providers, managed service providers, SaaS providers used by individual business units and development partners. The criticality assessment in step 2 then determines the depth of review. The Austrian statutory wording provides a useful structure for the assessment criteria, because it names the dimensions expressly — specific vulnerabilities of the provider, overall quality of the products, its cybersecurity practice and the security of its development processes (§ 32(4)(d) NISG 2026, applicable from 1 October 2026). The German statutory wording in § 30(2) no. 4 BSIG does not name these criteria expressly; as a structural grid for your own scoring they are nevertheless workable in practice. Also document the reasoning behind low scores: compliance with the measures must be documented under § 30(1) BSIG, and a reasoned exclusion is part of that.

Steps 3 and 4: self-assessment and audit

The self-assessment scales, the audit provides evidence — together they form the chain of evidence. The questionnaire goes to all suppliers and delivers a first, comparable set of data; for providers classified as critical it is not sufficient in practice, and there an on-site audit or the presentation of an ISO 27001 certificate follows. However, a certificate does not fully replace your own assessment — the gap in Annex A.15 is described in section 1. So check the scope of the certificate (which sites, which services) and reconcile it with the service actually purchased. For critical suppliers, a contractually anchored right to audit and incident notification to you as the client within 24 hours are among the mandatory elements of implementing this area.

Steps 5 and 6: contract and monitoring

The contract is the only instrument with which you can enforce security requirements at a third party — which is why step 5 is the lever on which audits most often fail. The six clauses from section 5 belong in your standard contracts, not only in new agreements: existing contracts are brought into line at the next renewal. Make sure that both the data protection layer and the NIS2 layer are covered — the delimitation between Art. 28 GDPR and § 30(2) no. 4 BSIG is set out in the FAQ at the end of this article. Step 6 keeps the relationship current: quarterly incident reports are an established practical rhythm, not a statutory deadline — the cycle should be based on criticality and should be set out in the contract.

Steps 7 and 8: incident plan and re-evaluation

The escalation workflow must be in place before the first incident, because the statutory clock starts on becoming aware and not at the point when the cause has been clarified. Define in the contingency plan who receives a supplier's notification, who assesses significance under § 2 no. 11 BSIG and who triggers the early warning under § 32(1) no. 1 BSIG; availability for this must be ensured at all times, including outside business hours. Step 8 closes the loop: the annual reassessment is a practical rhythm with which the assessment of the effectiveness of risk management measures required by § 30(2) no. 6 BSIG can also be evidenced for the supply chain area. Triggers outside the regular cycle: security incidents at the supplier, changes of sub-suppliers, contract renewals and material changes to the service purchased.

5. The 6 mandatory contract clauses

The following six clauses are the practical standard with which the requirements of § 30(2) no. 4 BSIG can be operationalised vis-à-vis a supplier — they translate the statutory reference points into enforceable contractual obligations:

1. Security standards: ISO 27001 or NIST CSF or equivalent — in writing. This is what makes the provider's cybersecurity practice measurable in the first place; without a reference framework, every assessment remains an assertion.
2. Incident notification: within 24 hours of becoming aware. This deadline is a contractual undertaking by the supplier towards you; the statutory 24-hour deadline in § 32(1) no. 1 BSIG, by contrast, applies to your own entity (see section 7).
3. Right to audit: an annual right to audit, where applicable through an independent third party. Without this right, the effectiveness of the measures at the service provider cannot be verified — area 6 of § 30(2) BSIG requires precisely this effectiveness assessment.
4. Sub-suppliers: list provided in advance plus approval of new sub-suppliers. The statutory wording addresses relationships with direct suppliers; transparency about their subcontractors is the contractual route to making the second tier visible at all.
5. Continuity plan: BCM/DR documentation available, RTO/RPO defined. Maintaining operations is governed as an area in its own right in § 30(2) no. 3 BSIG and comes to nothing if the critical service provider does not commit to reliable recovery times.
6. Termination: return of data plus documented secure deletion. If the supplier processes personal data on your behalf, setting out the subject matter, duration, nature and purpose of the processing is in any event a minimum content requirement of the contract under Art. 28(3) GDPR.

6. Prioritising critical suppliers

Prioritisation is not a convenience but the working method the law envisages: § 30(1) BSIG requires appropriate and proportionate measures, that is, a graded depth of review instead of treating all suppliers alike. Two axes carry the scoring — the impact of an outage on business operations and the sensitivity of the data the provider accesses. Criticality matrix (simplified):

How to read the table: the scores are illustrative values from practice, not a standardised key. A high score for data sensitivity regularly has a second consequence — if the provider processes special categories of personal data within the meaning of Art. 9(1) GDPR, such as health data, the data protection requirements for selection and contract (Art. 28 GDPR) apply alongside, and large-scale processing of such data may trigger a data protection impact assessment under Art. 35 GDPR. Practical recommendation: keep a list of critical suppliers separate from the overall inventory and link it to the contract references — in an audit interview, that is the document asked for first.

7. Incident at a supplier: deadlines and reporting channels

An incident at a supplier can trigger your own reporting duty — what matters is not where it originated, but whether it reaches the threshold of a significant security incident. That threshold is defined by § 2 no. 11 BSIG: a security incident that has caused or is capable of causing severe operational disruptions to services or financial losses for the entity, or that has affected or is capable of affecting other natural or legal persons through considerable material or non-material damage. EU Implementing Regulation 2024/2690 gives this threshold concrete shape with quantitative criteria, but only for certain digital types of entity such as DNS service providers, cloud and data centre services, managed (security) service providers, online marketplaces or trust service providers; for all other entities, the definition in § 2 no. 11 BSIG applies until a statutory instrument under § 56(5) BSIG is adopted.

A second clock runs alongside in data protection law: if the incident concerns personal data, the controller notifies the breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 33(1) GDPR); where a high risk to the rights and freedoms of natural persons is likely, communication to the data subjects is added (Art. 34(1) GDPR). Both chains of deadlines run independently of one another — the supplier's contractual 24-hour notification to you is the precondition for being able to meet either of them.

8. Evidence, documentation and review

Supply chain security is evidenced through documentation — and the evidence duties differ considerably between Germany and Austria. In Germany, the general rule of § 30(1) BSIG applies first: compliance with the measures must be documented. In addition, a periodic external evidence duty applies to operators of critical installations: they demonstrate implementation of the measures under § 30(1) in conjunction with § 31 BSIG through security audits, reviews or certifications — at a point in time set by the BSI, at the earliest three years after the first classification as an operator of a critical installation and every three years thereafter; the results, including any security deficiencies identified, must be transmitted (§ 39(1) BSIG). In Austria, the evidence route is broader: all essential and important entities transmit structured information on the risk management measures implemented to the Cybersecurity Authority within twelve months of the registration duty arising (self-declaration, § 33(1) NISG 2026); on request, implementation must be evidenced within two years by an independent body, and essential entities must demonstrate operational and organisational implementation within two months of the request (§ 33(2) NISG 2026). Since the NISG 2026 only becomes applicable on 1 October 2026, the first such request can be made at the earliest two years after entry into force. Practical recommendation for both jurisdictions: maintain a dossier for each critical supplier — criticality reasoning, self-assessment, certificate or audit report, contract version with the security clauses, incident history.

9. Management: duty and liability

Responsibility for supply chain measures lies with the management itself and cannot be delegated. § 38(1) BSIG obliges the management bodies of particularly important entities and important entities to implement the risk management measures under Section 30 BSIG and to monitor their implementation — area 4 included. If they breach these duties, they are liable to their entity for culpably caused damage under the rules of the company law applicable to the legal form; under the BSIG itself, management is liable only on a subsidiary basis, namely where the relevant company law contains no such liability rule (§ 38(2) sentence 2 BSIG). In addition, there is a duty to take part in training regularly (§ 38(3) BSIG). In Austria, the management bodies must ensure and supervise compliance with the risk management measures under § 32 NISG 2026 and take part in specifically designed cybersecurity training (§ 31(1) and (2) NISG 2026, from 1 October 2026); § 31 NISG 2026 does not contain an express internal liability rule analogous to § 38(2) BSIG. Practical recommendation: approval of the supplier risk assessment and of the contract clauses belongs in documented management minutes — without that record, the monitoring duty under § 38(1) BSIG is hard to evidence in an audit.

10. Sanction ranges in Germany and Austria

Breaches of the risk management duties — and therefore of area 4 as well — carry fines, with the upper limit depending on the classification of the entity.

Two details that are regularly misreported in Germany: the BSIG does not contain a blanket "whichever is higher" — the turnover variant applies only where total turnover exceeds EUR 500 million and only to the breaches designated in § 65(6) and (7) BSIG; total turnover is the sum of all worldwide turnover of the undertaking to which the entity belongs, in the financial year preceding the authority's decision (§ 65(8) BSIG). And where a data protection supervisory authority has already imposed a fine under the GDPR for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG). In Austria, other infringements carry up to EUR 50,000 from 1 October 2026, and up to EUR 100,000 in the case of repetition (§ 45(4) NISG 2026).

11. Practical examples 2025

• Mid-sized company, 250 employees: 47 suppliers identified, 8 of them critical. Audit effort: 12 person-days one-off plus 3 person-days per year.
• Large SME, 800 employees: 120 suppliers, 18 critical. ISO 27001 certificate as a standard requirement. 25 person-days one-off.
• Operators of critical installations: additionally an evidence duty under § 39(1) BSIG in conjunction with § 31 BSIG — implementation of the measures must be demonstrated to the BSI through security audits, reviews or certifications, at the earliest three years after the first classification as an operator of a critical installation and every three years thereafter.
• Energy suppliers: operators of energy supply networks, energy installations or digital energy services that are subject to §§ 5c to 5e of the German Energy Industry Act (EnWG) are exempt under § 28(5) no. 2 BSIG from §§ 30, 31, 32, 35, 36, 38, 39 BSIG — what governs there is the IT security catalogue under §§ 5c to 5e EnWG; the exemption does not apply insofar as further critical installations are operated beyond that. The former § 8a BSIG 2009 has not been applicable since the BSIG 2025 entered into force on 6 December 2025.
• Group with an Austrian subsidiary: registration and supervisory interfaces run separately — in Germany via the joint registration facility of BSI and BBK (§ 33(1) BSIG), in Austria with the Cybersecurity Authority (§ 29(2) NISG 2026, from 1 October 2026). The supplier assessment itself is largely reusable (details in the FAQ).