For organisations covered by NIS2, directly or through their chain
Substantiate your NIS2 supply chain duty of care
The NIS2 directive requires you to take appropriate measures to secure your supply chain, and has been enforceable in the Netherlands since 15 August 2026 through the Dutch Cybersecurity Act. Exposentry delivers continuous external measurements with an evidence trail for its findings: what is visible from the outside, dated and sealed.
What is the NIS2 supply chain duty of care?
NIS2, implemented in the Netherlands through the Dutch Cybersecurity Act (Cyberbeveiligingswet) and in force since 15 August 2026, requires essential and important entities to manage risks in their supply chain. Alongside your own security risks, you therefore manage the risks that come in through your direct suppliers and service providers.
The obligation applies directly to more than 8,000 essential and important entities (Dutch government estimate), and indirectly reaches their suppliers: those entities must also set security requirements for their supply chain. Regulators expect you to demonstrate which measures you take and to provide evidence of them. The knowledge base covers what is actually required under the duty of care.
What the Dutch Cybersecurity Act requires as a whole, article by article →
What the law asks of your supply chain
In the Dutch Cybersecurity Act, the supply chain duty sits in article 21(3)(d): the security of the supply chain, including the security aspects of the relationship with your direct suppliers and service providers. Paragraph 4 asks you, among other things, to weigh the specific vulnerabilities of each direct supplier and service provider, and the quality of their products and cybersecurity practices, including their secure development procedures. The Cybersecurity Decree sets this out in more detail in article 10: you lay down a written supply chain security policy and demonstrably apply it (paragraph 1). You also check whether your direct suppliers and service providers meet the security requirements you set on the basis of your risk analysis, and you review this periodically (paragraph 2; the requirements themselves follow from article 7(5)).
In practice this is also called supply chain responsibility: you manage the risks that come in through a supplier yourself, even if that supplier does not fall under the act. It concerns suppliers that can affect the security of your network and information systems; the explanatory notes to the Cybersecurity Decree give a supplier of pencils as an example of one that falls outside. How you check is up to you; the same notes give certification and clauses in supply contracts as examples. That is paper: a clause records what a supplier promises, a certificate shows that its management system was assessed at an earlier moment. An external measurement shows what is actually visible from the outside. If an auditor asks how you know it is true, having both gives you an answer.
What an auditor will want to see in practice: which direct suppliers affect the security of your systems and how heavily you weigh them, which security requirements you set them (for example in the contract), how and when you checked whether they meet them (questionnaire, certificate, measurement), and what you did when a supplier fell short. Together that is your supplier file.
How Exposentry substantiates your duty of care
Continuous monitoring
Continuous scanning of your public attack surface, so new vulnerabilities surface quickly instead of once a year.
A traceable evidence trail
Where the trail can be traced, OpenKAT records how and when a finding was detected. You can present that dated evidence trail to auditors, clients and insurers.
Findings mapped to standards
Where possible, findings in the report are indicatively mapped to controls from ISO 27001 and, if your sector is known, from a framework that fits it. That mapping is a starting point for your own assessment.
Suppliers in view
Alongside your own domains, monitor the external attack surface of critical suppliers. NIS2 + Supply Chain includes ten suppliers, each with a passive measurement based on public sources: DNS, certificate logs and internet indexes, without Exposentry scanning the supplier's systems itself. That picture is broad, but second-hand and not always current. If you want to see more, the supplier can provide a dated report of its own measurement.
Honest about what it is and isn't
Exposentry is a building block for your vulnerability management and supply chain duty: verifiable evidence that you continuously measure your external attack surface. NIS2 also covers governance, incident reporting and organisational measures, which fall outside a scan. Exposentry provides the technical evidence; the legal assessment stays with you and your adviser.
Are you the supplier who received a questionnaire?
This page was written for your customer. There is also a page for you: what you attach to the NIS2 questionnaire as a measurement, how that measurement works and what it costs.
What to attach to the questionnaire →Independence makes your evidence stronger
Demonstrating supply chain due care with a report from the party that manages your environment does not hold up with a critical auditor: that party is judging its own work. Exposentry therefore reports directly to you, never through your IT provider, and has laid down the separation from management and remediation work in its terms and conditions.
Frequently asked questions about NIS2 and the supply chain duty
Does Exposentry make me NIS2-compliant?
No. Exposentry provides a demonstrable technical building block: continuous external measurements with an evidence trail for its findings. NIS2 also requires governance, incident reporting and organisational measures that fall outside the reach of a scan.
Am I covered by the NIS2 supply chain duty?
If you are an essential or important entity, the duty applies directly. If you provide services to such an entity, they will likely set requirements for your security, meaning the supply chain duty affects you indirectly. The Dutch Cybersecurity Act has been in force since 15 August 2026: the regulator can hold the entity to account for how it manages its supply chain. As a supplier, you notice this through the requirements in your contract, questionnaires and audits.
How do I show that I manage my supply chain?
With a supplier file: which suppliers affect your systems, which requirements you set, how and when you checked, and what you did when a supplier fell short. With NIS2 + Supply Chain, a dated, passive measurement per supplier records alongside the questionnaire what was visible from the outside. On a subscription, each following report shows for your own domains how the number of findings per severity develops.
Can I also monitor my suppliers?
Yes, in the NIS2 + Supply Chain plan: ten suppliers, each with a passive measurement based on public sources. If a supplier cooperates, it can provide a dated report of its own measurement.
How supplier monitoring works →Is supply chain responsibility the same as supply chain duty?
Within NIS2, yes. Neither term appears in the act, which speaks of the security of the supply chain (article 21(3)(d)). Supply chain duty and supply chain responsibility are two common names for that obligation: you manage the risks that come in through your direct suppliers and service providers. Outside NIS2, supply chain responsibility also means something else, such as due diligence on human rights and the environment.
How often do I need to check my suppliers?
The act sets no fixed interval. The Cybersecurity Decree (article 10(2)) asks you to review periodically; according to the explanatory notes to the decree, you set and justify that interval yourself, based on your risks. With supplier monitoring in NIS2 + Supply Chain you also see what changes in a supplier's external attack surface between two questionnaire rounds.
What may I ask of a supplier?
Whatever fits the risk it poses: security requirements in the contract, a completed questionnaire or self-assessment, a certificate such as ISO 27001 where appropriate, a dated report of its external attack surface, and arrangements for reporting incidents to you.
Start with a verifiable measurement
The Dutch Cybersecurity Act has applied since 15 August 2026, without a general transition period. Start with a €495 baseline scan (fully credited against a yearly subscription) or continuous monitoring from €249/month.
Start nowPrefer to run OpenKAT yourself or need your own implementation? Hasecon provides implementation, management and custom development →