Compliance4 min read

NIS2 affects you even if you are not in scope yourself

Are you a supplier to a company covered by NIS2? Then it is only a matter of time before your customer's security requirements land on your desk – and one of the first questions will be who has access to what in your organisation.

Article: NIS2 requirements for suppliers

Background

The requirements roll down the supply chain

NIS2 requires in-scope companies to manage security across their entire supply chain – not just in their own systems. Article 21 of the directive explicitly names supply chain security as one of the measures management must have under control and can be held accountable for.

In practice, this means many in-scope companies are now setting concrete security requirements for their suppliers: in new contracts, in due diligence processes and in recurring supplier audits. If you are a supplier in manufacturing, logistics or IT operations, you do not need to be covered by NIS2 yourself before the requirements reach you – they come from your customers.

The customer's questions

What NIS2 customers typically ask about

Access overview: can you document who has access to the systems and data related to the customer's delivery?
Offboarding: how quickly is access revoked when an employee leaves – and can you prove it happens?
Privileged accounts: who has administrator rights, and how are they limited and monitored?
Incident handling: how do you detect and report security incidents that could affect the customer?
Documentation: can you produce policies and logs, or does the answer rest on memory and good intentions?

Why access governance is the right place to start

The question of who has access to what is simple to ask and often surprisingly hard to answer clearly. In many small and mid-sized companies, access is managed manually: in spreadsheets, through verbal agreements or ad hoc when an employee starts or leaves. That is not necessarily a sign of poor security, but it is hard to document to a customer who asks – and it increases the risk of old accounts remaining active long after they should have been closed.

If you cannot answer today, there is no reason to panic. But there is good reason to get started before the answer becomes a contractual requirement with a deadline. Access governance is also the most concrete and measurable of the supplier requirements – and therefore the area where a structured effort can be documented fastest.

It does not have to be a big project

The good news is that you do not need a multi-year IAM programme to answer credibly. By starting with the systems that matter most – typically HR, Active Directory and the key business systems – a consolidated overview and a documented process can be established within a few months.

In the next article, we walk through how to answer your customer's security requirements in practice, and what a phased approach looks like.

Read: How to answer your customer's security requirements

In short

The requirements come from the customer, not the authorities – via contracts and supplier audits.
Access governance is the most concrete and verifiable of the requirements.
A phased approach delivers demonstrable results in weeks, not years.