NIS2 supplier readiness

Three questions to tailor the check. NIS2 applies directly to organisations in certain sectors and sizes; many others feel it through their customers' supply-chain requirements. These answers are not scored.

1. Might your organisation itself fall within NIS2 — for example you're medium-sized or larger and work in a sector listed in the Directive (such as energy, transport, health, digital infrastructure, ICT service management, manufacturing or digital providers)?
2. Have customers asked you about NIS2, sent security questionnaires or proposed new security clauses in contracts?
3. Do you develop, maintain or host software or systems that customers rely on?

The basics stop most attacks: strong authentication, known assets, controlled access, timely patching, encryption and trained people.

1. Where do you use multi-factor authentication (MFA)? Knock-out IT lead
2. Do you keep an up-to-date inventory of your devices, software, cloud services and where important data lives? IT lead
3. Is access granted on a need-to-know basis, and removed promptly when people change role or leave? IT lead / HR
4. Typically, how many days does it take you to apply critical security updates to internet-facing systems? IT lead
5. When did all staff last complete cybersecurity awareness training? HR / Security lead
6. Which of these describe how you use encryption today? Select all that apply. IT lead

From the help text

Article 21 names multi-factor or continuous authentication where appropriate. Stolen passwords are the most common way in, so MFA on email, remote access and admin accounts matters most.

Incident handling, backups, disaster recovery and crisis management all sit within Article 21.

1. Do you have a written incident response plan that says who does what, how incidents are logged, and when customers and authorities are told? Evidence needed Security lead
2. Which best describes your backups of critical systems and data? Knock-out IT lead
3. Do you have a business continuity and disaster recovery plan that sets recovery targets for key services and has been tested? Operations lead

From the help text

Incident handling is one of the ten Article 21 measures. 'Yes' means a current plan with roles, contacts and escalation criteria.

If you build or run systems your customers depend on, Article 21 expects security across acquisition, development and maintenance — including how you handle and disclose vulnerabilities.

Asked only if you answer “Yes” to: Do you develop, maintain or host software or systems that customers rely on?

1. Do you follow defined secure development practices — such as code review, dependency scanning and separate test and production environments? Engineering lead
2. Do you have a way for outsiders to report vulnerabilities to you, and a process to triage and fix them? Engineering lead

From the help text

Customers want confidence that security is built in, not bolted on. 'Yes' means documented practices applied to every release.

Customers in scope of NIS2 will ask you for evidence and commitments. Being prepared saves time and wins trust.

Asked only if you answer “Yes” to: Have customers asked you about NIS2, sent security questionnaires or proposed new security clauses in contracts?

1. Upload your standard security evidence pack — the documents you send customers when they ask about your security. Evidence needed Security lead / Sales
2. Can you commit to notifying customers promptly about security incidents that affect them, with a named contact and a stated timeframe? Security lead / Legal
3. Do you review new customer security clauses before signing, to make sure you can actually meet them? Legal / Security lead

From the help text

A ready pack (policy summary, certificates, pen test summary, incident and continuity overview) turns a week of questionnaire work into an afternoon.

Ireland's National Cyber Security Bill will set out who is covered, the competent authorities, registration and incident reporting. Registration and reporting portals are not open yet, so these steps are about readiness.

Asked only if you answer “Yes” to: Might your organisation itself fall within NIS2 — for example you're medium-sized or larger and work in a sector listed in the Directive (such as energy, transport, health, digital infrastructure, ICT service management, manufacturing or digital providers)?

1. Have you formally assessed whether you are likely to be an essential or important entity, and recorded the reasoning? Compliance lead
2. Does your incident plan already allow for NIS2's staged reporting — an early warning within 24 hours, a notification within 72 hours and a final report within one month? Security lead
3. Has your board or management been briefed that, under NIS2, management bodies approve and oversee cybersecurity measures and can be held liable for infringements? Company secretary / Managing director

From the help text

Scope depends on your sector, services and size. 'Yes' means a short written assessment using the NCSC's scoping tool, reviewed once the Irish law is enacted.

NIS2 looks down the supply chain: the security of your key suppliers affects the service you give your customers. Finish by confirming your answers.

1. Do you keep a list of your key ICT suppliers and service providers, rated by how critical they are to your service? Procurement / IT lead
2. Do contracts with your critical suppliers include security requirements, incident notification and a right to ask for assurance? Procurement / Legal
3. I confirm these answers reflect our current security measures, and our security lead and management have reviewed them. Managing director

From the help text

Article 21 covers supply-chain security, including your relationships with direct suppliers. 'Yes' means a register showing what each supplier does, what data it touches and how critical it is.