NIS2 Compliance: How to Identify and Evaluate Critical Suppliers

As the NIS2 Directive reshapes the cybersecurity landscape across Europe, a key focus for organisations is understanding and managing their critical suppliers. The directive mandates heightened scrutiny and tighter controls around these essential entities, underscoring their importance in your overall cybersecurity strategy.

But the pivotal question remains: How do you determine who qualifies as a 'critical supplier'? Let’s delve into practical strategies to identify these crucial partners and ensure compliance with NIS2 requirements.

Identifying Critical Suppliers: A Strategic Imperative

With the NIS2 Directive emphasizing operational resilience, identifying which suppliers are 'critical' to your cybersecurity infrastructure is more crucial than ever.

A critical supplier is not just any vendor—it's one whose failure could significantly disrupt your operations or compromise your data security.

This definition requires a strategic approach, where the impact of a supplier is assessed not just in terms of service delivery, but also through the lens of potential risk to your cybersecurity posture. A payment processing partner, for example, plays a crucial role in transaction completions. A compromise in their systems could not only halt sales but also expose sensitive financial information, thereby attracting regulatory penalties and damaging customer trust.

The Directive states in Recital 85 that addressing supply chain risk is particularly important given the prevalence of incidents where malicious perpetrators were able to compromise organisations by exploiting vulnerabilities affecting third-party products and services—like the SolarWinds attack. In fact, ENISA predicts that ‘Supply Chain Compromise of Software Dependencies’ will be the most prominent cyber threat in 2030.

“Essential and important entities should therefore assess and take into account the overall quality and resilience of products and services, the cybersecurity risk-management measures embedded in them, and the cybersecurity practices of their suppliers and service providers, including their secure development procedures.”

So how do you put that into practice? There are three key initiatives that will help you get a hold on the security posture of your critical suppliers.

Practical Steps to Classify Critical Suppliers

1. Perform a Comprehensive Risk Assessment

As part of your Vendor Risk Management program, you will need to identify, evaluate, and prioritise suppliers’ risks to determine how integral they are to your operations and the potential impact of their compromise. This encompasses identifying potential threats and vulnerabilities, assessing the likelihood and impact of these threats materialising, and determining the organisation's readiness to address them.

Consider aspects like access to sensitive data, integration with critical systems, and compliance with relevant cybersecurity standards. These can be embedded into your requirements across the vendor onboarding process, including assessments, questionnaires, and certifications.

Example: For an energy utility company, a supplier providing smart grid control software would undergo a thorough risk assessment to gauge vulnerabilities that could disrupt power distribution.

For more information and practical examples, download our ebook: 40 Questions You Should Have In Your Vendor Security Assessment.

2. Calculate Supplier’s Business Impact

Determine the criticality of each supplier to your operations. This analysis should consider the potential repercussions on your business should the supplier's services be disrupted, looking at factors like the supplier's role in your supply chain, the cost and challenges associated with replacing the supplier, and the overall impact on operational continuity.

Example: A public transportation provider may evaluate a traffic management system vendor to assess the potential impacts on transit operations and commuter safety if the vendor’s systems were compromised.