NIS2 for suppliers: what you will be asked if you sell to a NIS2 entity in Romania

Illustration: a NIS2 entity connected to verified suppliers

If your company is not an essential or important entity, NIS2 can still reach you through your customers. Romania’s GEO 155/2024 requires in-scope entities to manage supply chain security, which means assessing their suppliers and asking them for assurances. Those requests arrive as contract clauses, questionnaires, evidence requests and audits.

Key points

  • Supply chain security is a mandatory minimum measure for NIS2 entities (Art. 13(d) of GEO 155/2024).
  • Entities must take into account the vulnerabilities and security practices of each direct supplier and service provider (Art. 11(8)).
  • On DNSC’s request, entities must report data on their cloud, data centre, managed service and managed security service providers (Art. 11(9)).
  • A supplier outside NIS2 scope has no direct duties towards DNSC, but it does have whatever it signs in the contract.
  • Suppliers who prepare early turn the requirement into a sales advantage.

What does the law say about the supply chain?

GEO 155/2024 covers the supply chain in three places.

Art. 13(d) lists among the minimum measures “supply chain security, including security aspects of the relationship between the entity and its direct suppliers and service providers”.

Art. 11(8) sets out what must be considered: the specific vulnerabilities of each direct supplier and service provider, the overall quality of products, the quality of suppliers’ cybersecurity practices including their secure development processes, and the results of coordinated EU risk assessments of critical supply chains.

Art. 11(9) lets DNSC ask entities for data on the trust service providers, DNS providers, domain registries and registrars, cloud, data centre, managed service and managed security service providers they use.

In short, a NIS2 entity must know who its suppliers are, what risk each brings and what it has done to reduce that risk. The NIS2 Directive follows the same logic in Art. 21(2)(d) and 21(3).

We are not in scope. Why does this concern us?

Because your customer’s obligation becomes your commercial requirement. An essential entity buying IT services, maintenance, software, hosting or remote access to its systems cannot show compliance without showing how it controls its suppliers.

Start by checking your own scope. Some companies that see themselves as “just suppliers” are in scope themselves, for example managed service and managed security service providers. An indicative check is available on CysNIS.

If you are not in scope, you have no registration, notification or self-assessment duties towards DNSC. You do have the duties you accept by contract, and those can be detailed.

What will a supplier actually be asked for?

Typical requirement What it means for the supplier Why the customer asks
Security questionnaire Documented answers about your controls Per-supplier risk assessment (Art. 11(8))
Multi-factor authentication MFA on accounts with access to customer systems Minimum measure (Art. 13(j))
Incident notification Informing the customer within a short contractual deadline The customer has its own 24 h, 72 h and one-month deadlines
Logging and traceability Keeping access logs for customer systems Traceability of all activity (Art. 11(4))
Vulnerability management Timely updates, reporting product vulnerabilities Secure development and maintenance (Art. 13(e))
Right to audit Accepting an audit or equivalent evidence Checking declared practices
Continuity Backups and recovery for the service delivered The customer’s business continuity (Art. 13(h))
People and access Lists of people with access, revocation on departure Access control (Art. 13(f))
Subcontractors Disclosure and approval of subcontractors The chain does not stop at tier one

The customer’s own deadlines for significant incidents are covered in our article on NIS2 incident notification in Romania. Your clause must leave them time to meet those deadlines.

How does a NIS2 entity assess its suppliers?

A proportionate approach that holds up in an audit has five steps:

  1. Supplier inventory, linked to the asset inventory: who accesses which system, which data they process, which critical service they support.
  2. Risk classification: a stationery supplier is not treated like a supplier with admin access to the network.
  3. Tiered requirements: a minimum set for all suppliers, extended requirements for critical ones.
  4. Contract clauses for new suppliers and amendments for existing ones, prioritised by risk.
  5. Monitoring and reassessment: annual evidence, review after incidents or major changes.

The result must be documented. Besides the asset and risk lists DNSC can request under Art. 11(7), the entity can be asked about its digital service providers (Art. 11(9)) within the deadline set in DNSC’s request, so the register needs to exist beforehand.

How does a supplier become a trusted supplier?

Preparation pays off directly: in tenders and negotiations with NIS2 entities, the supplier that answers questionnaires completely and quickly gets through selection more easily.

Supplier readiness checklist:

  1. A short document describing the security controls applied to the service you deliver.
  2. MFA on every account with customer access.
  3. An incident response procedure with a customer notification deadline.
  4. Access logs kept and available on request.
  5. An update and vulnerability management process.
  6. Tested backups of customer data.
  7. A list of subcontractors and the data they can access.
  8. A recent security test of customer-facing applications.
  9. A named security contact known to customers.
  10. A model answer set for common questionnaires, updated yearly.

Be wary of “NIS2 certification” offers for suppliers. NIS2 does not certify organisations, as explained in NIS2 certification: what exists and what is sold. Customers care about concrete evidence.

What about ICT providers to the financial sector?

DNSC Order 1/2026 includes an exception: entities in the “ICT service management (business-to-business)” sector that are designated critical ICT third-party providers under DORA, Regulation (EU) 2022/2554, apply the DORA measures and do not carry out DNSC’s risk-level assessment. Other suppliers serving financial customers will see DORA requirements in their contracts alongside NIS2 ones.

Common mistakes

  • One questionnaire for everyone. It produces hundreds of answers nobody reads. Requirements should follow risk.
  • Clauses without a notification deadline. “The supplier will inform the customer” does not help when the customer has 24 hours for its early warning.
  • Forgetting remote access. Maintenance providers with permanent VPN or remote administration access are often the biggest risk.
  • No revocation. Supplier accounts still active after the contract ends.

How ProDefence can help

Members of the ProDefence team are DNSC-attested NIS auditors, and ProDefence works on both sides of the contract.

For NIS2 entities, NIS2 consulting (from EUR 10,000 per project) covers the supplier register, risk classification, tiered requirements and contract clauses. A NIS2 audit (from EUR 5,000 per engagement) checks that the process works. In CysNIS, supplier risks are managed together with other risks and the DNSC Order 1/2026 controls.

For suppliers, penetration testing provides recent technical evidence for customer questionnaires, and consulting helps you assemble the document set requested in tenders.

Frequently asked questions

Do we have to comply with NIS2 if we only supply a NIS2 entity?

Not directly. A supplier that is not an essential or important entity has no registration, notification or self-assessment duties towards DNSC. It does have the obligations it accepts by contract, which the NIS2 customer must require in order to manage its supply chain under Art. 11 and Art. 13(d) of GEO 155/2024.

Which article of GEO 155/2024 covers suppliers?

Art. 13(d) lists supply chain security among the minimum measures. Art. 11(8) says what must be assessed for suppliers, and Art. 11(9) allows DNSC to request data on cloud, data centre, managed service and managed security service providers.

Can a customer audit our company?

Only if you agreed to it in the contract. Many NIS2 entities will ask for a right to audit or equivalent evidence, such as test reports or security management certifications, for suppliers with access to critical systems.

What incident notification deadline should we accept?

One that lets the customer meet its own deadlines: early warning within 24 hours, notification within 72 hours and a final report within one month for significant incidents. Customers will usually ask for less than 24 hours.

Is there a NIS2 certification for suppliers?

No. NIS2 does not provide for certifying organisations. Customers assess suppliers on evidence: questionnaire answers, technical controls, test reports and security management certifications where they exist.

How do we prioritise hundreds of suppliers?

Classify them by risk: system access, type of data processed and the critical service supported. Critical suppliers get a full assessment and extended clauses, the rest a minimum set. Review annually and after incidents.

Sources

Alexandru Angheluș, ProDefence. Cybersecurity and NIS2 compliance specialist at ProDefence, whose team includes DNSC-attested NIS auditors.

Digital evidence in a criminal case: the path from incident to courtroomIllustration: a laptop, phone and hard drive linked by a chain of custody to a case file
Skip to content