Published: 6 August 2026.
Short answer: not automatically. But the situation is a little more complex in practice and depends on whether the supplier itself is covered by the law.
Two Situations
1. The Supplier Itself Falls under NIS2
If the supplier is, for example, a cloud provider or telecoms operator within the scope of the directive, it must meet NIS2 requirements regardless of whom it does business with.
2. The Supplier Is Not Subject to NIS2
If it is not covered by the law, it has no direct legal obligation. However, NIS2 requires organisations that are subject to it to take care of the security of their supply chain. This means they will often require the following of their suppliers:
- MFA (multi-factor authentication)
- Backups and recovery plans
- Incident response procedures
- Security policies
- Certain certificates or evidence of security measures
- The right to carry out security audits
The Simplest Explanation
NIS2 does not automatically bind suppliers, but it obliges their clients to manage the risks suppliers pose.
If you are a supplier of IT/security services and a client is asking you for evidence of compliance, request a free consultation to find out exactly what you need to prepare.