Published: 6 August 2026.
No. You are obliged to assess the risks your suppliers pose — not to demand the same level of compliance from all of them.
The Principle of Proportionality
The more important a supplier is to your business — cloud provider, hosting, MSP, IT support — the more security measures you will require of it. NIS2 applies the principle: requirements must be proportionate to the risk.
A concrete example: the company maintaining your servers will have to meet much stricter requirements than the company supplying your office stationery. The first has direct access to your critical systems; the second has none.
What This Looks Like in Practice
Instead of a universal list of requirements for all suppliers, you assess each one based on:
- How much access they have to your systems or data
- How much their outage would affect your business
- Whether they process sensitive or critical data
The Simplest Explanation
You do not have to treat all suppliers the same — assess the risk of each one individually and require measures proportionate to that risk.
If you need help with supply chain risk assessment, request a free consultation.