Written by the NIS2Compass Team ·
There are two routes by which NIS2 reaches suppliers. You are directly in scope if your own activity matches an entity type in Annex 1 or 2 BSIG and your company has at least 50 employees or more than EUR 10 million in both annual turnover and balance sheet total. This applies, for example, to many manufacturers of machinery, electronics or vehicle parts. You are indirectly affected if customers subject to NIS2 must ensure supply chain security under Section 30(2) no. 4 BSIG and pass these requirements on to you. NIS2Compass helps you separate the two cleanly and answer customer requests with solid evidence.
Check your own activity
What counts is your own activity, not your customer's. Manufacturers of machinery (NACE 28), electrical equipment (27) or vehicle parts (29), for example, are listed in Annex 2 BSIG. Managed service providers are listed in Annex 1. If your activity matches no entity type in the annexes, you are not directly in scope.
Size threshold
You are directly in scope only from 50 employees or more than EUR 10 million in both annual turnover and balance sheet total (Section 28(2) BSIG). Data of linked enterprises is not added if your IT is operated independently (Section 28(4) BSIG).
Indirectly through the supply chain
Even below the thresholds or outside the sectors, your customers' requirements reach you: questionnaires, evidence such as ISO 27001 or TISAX, and contract clauses. The legal basis is the customer's duty, not a duty of your own under the BSIG.
Many suppliers mistake the customer's duty for their own. Conversely, Annex 2 manufacturers overlook that they themselves must register and report.
Every customer asks differently: their own Excel lists, supplier portals, self-assessments. Without a central answer base, inconsistent statements to different customers arise.
Framework agreements are extended with security requirements, such as incident notification duties, evidence and audit rights. Whatever you sign, you must also be able to honour in daily operations.
Customers subject to NIS2 must report significant incidents no later than 24 hours after becoming aware (Section 32 BSIG). If an incident on your side affects their services, they depend on prompt information from you.
Self-assessments are not enough for every customer. Evidence such as an ISO 27001 certificate or a TISAX label is used but does not automatically answer every question on Section 30 BSIG.
Supply chain questions do not end with you. The BSI recommends that customers understand their supply chain including sub-suppliers. Expect questions about your cloud providers, software vendors and remote maintenance access.
Example: A surface coating service provider (NACE 25) with 180 employees supplies a car manufacturer. Its own activity matches no entity type in the annexes of the BSIG, so there is no direct NIS2 obligation. Nevertheless, the customer sends a security questionnaire and a new contract annex with incident notification duties. With NIS2Compass, the IT manager first clarifies what the customer itself must do under Section 30(2) no. 4 BSIG and which questions follow from it. The team then uses templates from the Template Library (supplier security questionnaire, contract clause set, supplier security policy) to build an answer base with evidence that it reuses for other customers.
Knowledge Hub
40+ articles, including supply chain security and contract clauses
Template Library
Supplier questionnaire, contract clause set, supplier inventory
NIS2 Guide
Structure along the ten measures of Section 30 BSIG
The BSIG requires the customer subject to NIS2 to ensure the security of its supply chain, including security-related aspects of its relationships with direct suppliers and service providers. The law does not prescribe a specific questionnaire or certificate. How the customer fulfils the duty is up to the customer.
The NIS2 Directive specifies: entities take into account the specific vulnerabilities of each direct supplier and the overall quality of its products and cybersecurity practices, including the security of its development processes. This explains questions about your ISMS, your processes and your software development.
In its #nis2know webinar (April 2026), the BSI names four measures for a secure supply chain: contractual agreements with suppliers on risk management, incident handling and patch management; security by design and by default; observing BSI recommendations; and an ISMS based on existing standards such as ISO 27001. You should be prepared for these points.
Your customer must report significant incidents in a cascade: 24 hours, 72 hours, one month. If you are not an entity under Section 28 BSIG yourself, you have no reporting duty under Section 32. Your duty to inform the customer then follows from the contract.
If you fall under Section 28 BSIG yourself, all duties apply directly: registration with the BSI within three months (Section 33), risk management measures (Section 30), reporting duty (Section 32) and management duties (Section 38). You then answer customer questionnaires from your own implementation.
| Kriterium | NIS2Compass | Klassische Beratung | ISMS-Tool | Selbstumsetzung |
|---|---|---|---|---|
| Monthly cost | €29 | €700-1,600/day | €200-2,000/month | €0 |
| Structured questionnaire answers | yes (articles + templates) | individual (expensive) | often not core focus | separate answers per customer |
| Suitable for multiple customers | yes, reusable | billed per project | yes, but expensive | build yourself |
| Assessment of contract clauses | yes (Knowledge Hub) | yes | rarely | build yourself |
| Onboarding | 10 minutes | days to weeks | days + setup | months |
| Scaling with growing customer base | cost-neutral | linear increase | linear increase | linear increase |
Classification, templates from the customer perspective and a reusable answer base for €29/month, cancellable monthly.
TISAX® is a registered trademark of the ENX Association. NIS2Compass has no business affiliation with the ENX Association, is not an audit provider approved by ENX and does not conduct TISAX assessments.