What does your large customer ask under the NIS2 supply-chain duty of care?

Published on May 12, 2026

This article is general information about laws and regulations, not legal advice.

Your own organisation may not fall under NIS2 itself, but you do supply software, hosting, advice or components to a hospital, a grid operator, a municipality or a large industrial party. If so, there is a good chance that you have recently received a questionnaire, a supplier assessment or an amended contract on your desk. That is a direct consequence of the supply-chain duty of care under NIS2, moving through the chain, all the way to you.

What are NIS2 and the Cybersecurity Act?

NIS2 is the revised European directive for network and information security. The Netherlands transposes that directive into the Dutch Cybersecurity Act (Cyberbeveiligingswet). The law requires organisations in essential and important sectors, think energy, drinking water, healthcare, digital infrastructure, transport and government, to take appropriate technical and organisational measures, report incidents and hold their board accountable for cybersecurity. A lot of nonsense circulates around these obligations; what the law does and does not require, and when the Cybersecurity Act takes effect, is laid out in what the NIS2 supply-chain duty of care really requires.

The reach is broad. It is estimated that tens of thousands of organisations are affected directly and indirectly. Directly: the organisations that fall under the law themselves. Indirectly: the many SME suppliers and freelancers that supply those organisations. After all, a party subject to NIS2 may not ignore the risks in its supply chain.

Why the supply-chain duty of care affects you too

One of the less visible but far-reaching parts of NIS2 is the duty of care for the supply chain. That duty is set out in Article 21(2)(d) of the NIS2 directive: supply-chain security. NIS2 organisations must assess the security risks of their suppliers and service providers and set appropriate requirements for them. Those requirements do have to be proportionate to the risk you introduce and your role in the chain: a customer cannot demand everything without limit, and a marketing supplier rightly faces lighter requirements than whoever hosts core systems. An attacker who cannot get in through the hospital's front door is, after all, only too happy to get in through a supplier with a hole.

In practice that translates into concrete questions for you:

How do you keep your systems and domains current and patched?
How do you know you do not have outdated software or open admin panels exposed to the internet?
How do you demonstrate that you look at vulnerabilities structurally, all year round?
How do you manage TLS certificates, DNS and access to your environment?

This is what such a request often looks like in a Vendor Security Assessment (VSA). An example of a typical question:

"Describe your process for patch management and vulnerability management. Indicate within how many days critical vulnerabilities in internet-facing systems are remediated, and attach evidence of the most recent vulnerability scan. Also confirm whether Multi-Factor Authentication is enforced on all systems from which [customer name] data can be accessed."

So it is rarely about a formal NIS2 certificate, and much more often about being able, as a supplier, to demonstrate that your digital basics are in order. That is called basic cyber hygiene, and it is well within reach for SMEs. How to answer this kind of question convincingly is covered step by step in how do you answer a NIS2 supplier questionnaire.

And what happens if you do not cooperate? No law directly compels you as a non-NIS2 supplier. But if you cannot show demonstrable basic security, your NIS2-obligated customer has to cover that risk somewhere else. In practice that means you can drop out of a project or tender, that an existing contract is not renewed, or that contractual security requirements are imposed on you. That is sober commercial reality: the customer picks the supplier that introduces the least risk.

What a small supplier can do in practice

You do not have to set up a security department to be a credible supplier. Start by making visible what is exposed at the outside of your organisation. A good first step is understanding what an attacker sees of your domain: which ports are open, is outdated software running, are there forgotten subdomains?

Concrete, affordable measures you can take today:

Map your attack surface. You can only protect what you know about.
Monitor for vulnerabilities structurally. The internet changes daily; a snapshot ages quickly.
Patch and remediate what you find, and record what you have done.
Keep evidence. Reports with a date and a finding are exactly what a purchaser or CISO wants to see.

Demonstrate, don't assert

The difference between "we do security" and "here is our report from last month" is enormous. A completed questionnaire is paper: it shows a snapshot and a promise. An external measurement shows what is technically visible at the outside of your environment. A large customer that takes its own supply-chain duty of care seriously wants that defensible evidence in hand. Periodic, documented scans of your domain and infrastructure deliver exactly that.

Important to be honest about: a scan does not make you "NIS2-compliant". NIS2 asks for more than technology: think governance, risk management, incident reporting and board accountability. At the same time, scanning is a necessary building block and delivers defensible evidence for vulnerability management and the supply-chain duty of care. We explain that distinction further in scanning is not NIS2 compliance.

How Exposentry fits in

Exposentry gives you that evidence layer without you having to run a scanner yourself. Under the hood, Exposentry runs on OpenKAT, the open-source security scanner of the Dutch government, to which founder Edward Hasekamp contributes as a collaborator. We map your domain and infrastructure, monitor for vulnerabilities and deliver reports that you can submit directly to your client. You get sober, substantiated findings that show your basics are in order.

Want to know which approach suits your organisation? See the plans and pricing or start straight away with a first scan. A small investment that makes the conversation with a large customer a lot easier.

Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.