NIS2 for suppliers
Countries: Netherlands ยท Change
NIS2 for suppliers lists what Annex 5 of Commission Implementing Regulation (EU) 2024/2690 makes a customer demand of its suppliers and service providers, written from the supplier's side: what you show, meet, or allow when your customer is bound by that Regulation. Its Requirements apply only to suppliers of the eleven entity types the Regulation covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. Each Requirement is optional, so a supplier whose customers are not of those types decides them out. Adopt NIS2 too for the measures your own service has to meet; this Framework does not repeat them. National duties follow from the country Sub-frameworks, which are adopted with this Framework for the countries you list. The body text in this catalog consists of plain-language summaries authored for ISMS, not the verbatim text of the Regulation. Customers needing the authoritative text should reference the official Regulation at https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj.
Requirement bodies below are plain-language summaries authored by Compliance. For the verbatim text of the standard, reference the publication from your national standards body (NEN, BSI, ANSI, ...).
Supply chain security (11)
Show your customer your cybersecurity practices, including your secure development procedures, so that it can weigh them when it selects and contracts you. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Be able to meet the cybersecurity specifications your customer sets for the service, and show that you do. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Show your customer the overall quality and resilience of the ICT products and services you supply, and the cybersecurity risk-management measures built into them, including their risks and classification level. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Meet the cybersecurity requirements the contract sets for you, including the requirements for security when your customer acquires ICT services or products (Annex point 6.1). Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Meet the requirements your customer sets for the risk awareness, skills, and training of your staff and, where it asks for them, for their certifications. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Verify the background of your staff to the extent your customer requires, and be able to show your customer that you did. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Notify your customer without undue delay of every incident that puts the security of its network and information systems at risk. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Allow your customer to audit you, or supply it with audit reports on your service. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Address the vulnerabilities in your service that put the security of your customer's network and information systems at risk. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Follow your customer's rules on subcontracting and, where it allows you to subcontract, impose the same cybersecurity requirements on your subcontractors as the contract sets for you. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
When the contract ends, return the information you hold for your customer and dispose of it, as the contract requires. Decide this in only if your customer is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.