What do NIS2 and the Cybersecurity Act require from a supplier?

In brief

NIS2 means the NIS2 Directive (EU) 2022/2555, and the Cybersecurity Act means Finland’s Cybersecurity Act 124/2025. If your customer is covered, the law does not automatically make every supplier a covered operator, but it does make supplier security part of the customer’s own cyber risk management. The customer must consider direct suppliers, service providers, product and service quality, resilience, controls, vulnerabilities, and cybersecurity practices. For a supplier, this usually means being ready to show practical evidence on risk management, incidents, continuity, supply-chain security, encryption, access control, and staff security.

The customer’s obligation reaches the supply chain

A direct supplier is the party the customer buys from directly. A cloud service, outsourced maintenance partner, software provider, or equipment supplier can be a direct supplier if the contract is with that party.

NIS2 Article 21 requires essential and important entities to use appropriate and proportionate technical, operational, and organisational measures to manage risks to network and information systems. The same article says those measures must include supply-chain security. It also names the security aspects of relationships between each entity and its direct suppliers or service providers.

The Cybersecurity Act section 9 follows the same structure for Finnish operators. It requires proportionate technical, operational, or organisational controls under a cybersecurity risk management model. That model must consider the general quality and resilience of direct suppliers’ products and service providers’ services. It must also consider the controls included in them and the cybersecurity practices of direct suppliers and service providers.

This is the key point for a supplier. The customer cannot treat supplier security as a side issue. If the supplier’s system, product, or service can affect the customer’s network and information systems, the customer needs a basis for judging that risk.

The law does not say that the supplier must use one named document or one named questionnaire. It points to the risk topic. The customer then decides what evidence is suitable for the relationship, the service, and the risk.

Supplier evidence relates to the same topics as the customer’s own risk management

A customer covered by NIS2 or the Cybersecurity Act usually asks suppliers about the same areas that the customer must manage internally. This is not a separate supplier checklist in the statutes. It follows from the fact that Article 21 and section 9 both include supply chain as part of the same risk management system.

The practical question is simple. Can the supplier show that it manages the risks that could affect the customer’s service, data, systems, or continuity?

What the customer may need to understand	Where the topic comes from	What supplier evidence usually tries to show
Risk analysis and security policies	NIS2 Article 21 and Cybersecurity Act section 9	The supplier knows its main cyber risks and has agreed ways to manage them.
Incident handling	NIS2 Article 21 and Article 23, and Cybersecurity Act section 9	The supplier can detect, assess, escalate, and communicate incidents.
Continuity, backups, recovery, and crisis management	NIS2 Article 21 and Cybersecurity Act section 9	The supplier can keep critical service elements running or restore them.
Supply-chain security	NIS2 Article 21 and Cybersecurity Act section 9	The supplier manages risks from its own direct suppliers and service providers.
Security in acquisition, development, and maintenance	NIS2 Article 21 and Cybersecurity Act section 9	The supplier handles system changes, maintenance, and vulnerabilities in a controlled way.
Effectiveness of controls	NIS2 Article 21 and Cybersecurity Act section 9	The supplier checks whether its cybersecurity measures work.
Basic cyber hygiene and cybersecurity training	NIS2 Article 21 and Cybersecurity Act section 9	Staff know everyday security practices, such as safe handling of access and messages.
Cryptography and encryption	NIS2 Article 21 and Cybersecurity Act section 9	The supplier has rules for protecting information with cryptography and, where needed, encryption.
Staff security, access control, authentication, and asset management	NIS2 Article 21 and Cybersecurity Act section 9	Access is limited, identities are checked, and important assets are known.

An everyday example is an outsourced system administrator. If that supplier has broad access to the customer’s systems, access control and staff security matter. If a supplier hosts data or keeps a service running, continuity and incident handling matter. If a supplier builds software, vulnerability handling and secure maintenance matter.

The related internal training question is covered further in NIS2 and the Finnish Cybersecurity Act: management training and staff cyber hygiene.

Incidents are the shared time-critical point for the supplier and the customer

An incident means an event that affects the security of network and information systems. In everyday terms, it may be an intrusion, harmful code, an unavailable service, unauthorised access, or another security event that can disturb the service.

NIS2 Article 23 sets reporting duties for essential and important entities when an incident has a significant impact on their services. A significant incident is one that has caused or can cause serious operational disruption or financial loss to the entity, or has affected or can affect other natural or legal persons by causing considerable material or non-material damage.

The same article sets the timeline for reporting to the Computer Security Incident Response Team, or CSIRT, or to the competent authority, as applicable:

• an early warning without undue delay and in any event within 24 hours after becoming aware of the incident;
• an incident notification without undue delay and in any event within 72 hours after becoming aware of the significant incident;
• an interim report if requested by the Computer Security Incident Response Team or the competent authority;
• a final report no later than one month after submitting the 72-hour incident notification;
• if the incident is still ongoing when the final report is due, a progress report at that time and a final report within one month after the incident has been handled.

These deadlines apply to the covered entity named in Article 23. But a supplier can decide whether the customer can meet them in practice. If the supplier sees the incident first, the customer may need facts from the supplier to decide whether the incident is significant, how serious it is, what the impact is, and whether there are cross-border effects.

For this reason, customer contracts and security requirements often focus on fast escalation. The statutes do not prescribe the contract wording. They do explain why time matters.

The incident reporting topic continues in What must be reported after a cybersecurity incident, and when?.

The Cybersecurity Act stresses proportionality and keeping measures up to date

Proportionality means that the measure must fit the risk. A small support service and a critical operating platform do not create the same exposure. A supplier with administrator access is different from a supplier with no access to systems or data.

NIS2 Article 21 says the measures must be appropriate and proportionate. It also says the assessment must consider the entity’s exposure to risk, size, incident likelihood and severity, and societal and economic impact.

The Cybersecurity Act section 9 uses the same idea in Finnish law. It requires measures to be proportionate to the nature and scale of the activity, the reasonably foreseeable direct effects of an incident, the risk exposure of the operator’s networks and information systems, the likelihood and severity of incidents, the cost of measures, and the technical possibilities available in light of up-to-date development.

This matters in supplier discussions. The customer should not need the same evidence from every supplier. The evidence should match the role of the supplier in the customer’s service. The supplier should expect deeper questions when the service is critical, connected to important systems, or hard to replace.

Section 9 also says the risk management model and controls must be kept up to date. For supplier management, this means a one-time questionnaire is usually not enough for a higher-risk relationship. The customer may need renewed evidence when the service changes, the risk changes, or the supplier’s role changes.

What the law does not automatically require from the supplier

The limits are important.

First, NIS2 Article 21 and the Cybersecurity Act section 9 do not say that every supplier of a covered customer becomes a covered operator. The obligations in those provisions are framed for essential and important entities or operators. A supplier may have its own statutory duties only if it is itself within the relevant scope. That scope is not determined by the supply-chain wording alone.

Second, the statutes do not name one mandatory certificate, standard, audit report, or questionnaire for all suppliers. They name risk management areas. The customer must decide what evidence is appropriate and proportionate for the supplier relationship.

Third, the statutes do not remove the customer’s own responsibility. A covered customer cannot outsource the legal duty to manage cyber risks simply by using a supplier. The customer still needs a risk management model and controls.

Fourth, Article 23 does not create a general incident report from every supplier to every customer in all circumstances. It sets reporting duties for covered essential and important entities toward the Computer Security Incident Response Team or the competent authority, and in some cases toward service recipients. Supplier-to-customer notice is therefore mainly handled through contracts, processes, and the customer’s need to meet its own statutory deadlines.

Fifth, the statutes leave room for sector-specific detail. The Cybersecurity Act section 9 says the supervisory authority may issue technical regulations that specify risk management duties in its sector. NIS2 Article 21 also refers to European Commission implementing acts for technical and methodological requirements for named types of providers.

Good supplier readiness is built from six practical capabilities

A supplier that serves covered customers benefits from being ready in six areas. These are not separate legal labels. They are a practical way to organise the areas named in NIS2 Article 21 and the Cybersecurity Act section 9.

1. Cyber risk management and security policies. The supplier can explain the main risks in its service and the rules used to manage them.

2. Incident handling and notification support. The supplier can detect incidents, assess impact, preserve facts, and give the customer information quickly enough for the customer’s own process.

3. Continuity and preparedness. The supplier has thought through backups, recovery, crisis management, and service restoration where these are relevant to the service.

4. Supply-chain cybersecurity. The supplier understands which of its own direct suppliers or service providers can affect the service and how their risks are managed.

5. Encryption, authentication, and access control. The supplier can explain how access is limited, how users are authenticated, and how cryptography or encryption is used where needed.

6. Security management system thinking. The supplier can show that controls are not isolated promises. They are maintained, reviewed, and improved when risks, systems, or services change.

For the customer, this makes supplier assessment more concrete. For the supplier, it reduces repeated ad hoc answers. The discussion moves from generic trust to evidence that maps to the customer’s statutory risk management duties.

For staff-level cyber hygiene, the related baseline is discussed in What does the Cybersecurity Act require for staff training?.