# NIS2 Supplier Requirements: What Evidence Non-EU Suppliers Need Before Their EU Customer Asks

> NIS2 supplier requirements shape the security questions EU customers send their suppliers. Learn what evidence they expect and a seven-step plan to prepare.

Source: https://digitalbridge.com.tr/en/blog/nis2-requirements-for-suppliers.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Cyber Security & Compliance
Published: 2026-10-28 · Updated: 2026-10-30

NIS2 supplier requirements are the cyber security measures and evidence that organisations covered by the EU's [NIS2 Directive](https://digitalbridge.com.tr/en/glossary.html#nis2) demand from their direct suppliers to secure their own supply chain. For most suppliers in Türkiye or elsewhere outside the EU, the Directive does not apply directly, but it reaches them through contracts, security questionnaires and audits.

## Key takeaways

- NIS2 (Directive (EU) 2022/2555) does not apply directly in Türkiye; EU customers pass their supply chain duty to suppliers through contracts, questionnaires and audits.
- Article 21 lists ten risk-management measures; point (d) is supply chain security, and customers want policies, records and test evidence rather than a "yes".
- An in-scope customer must send an early warning within 24 hours and a notification within 72 hours, so it expects suppliers to report faster.
- According to Verizon's 2026 DBIR, breaches involving a third party rose 60% in a year to reach 48% of all breaches.
- As of 2026, the quickest wins are MFA, isolated backups with restore testing, a written incident notification procedure and a separated production network.

## Why your EU customer suddenly sent a security questionnaire

The pattern is familiar to many exporters. A German or Italian customer you have served for years sends a "supplier cyber security assessment" with dozens of questions covering [multi-factor authentication (MFA)](https://digitalbridge.com.tr/en/glossary.html#mfa), backups, incident reporting times and your own subcontractors. A simple "yes" is rarely enough: they want a policy, a screenshot or a test record. Procurement then makes the response a condition of the next contract or order renewal.

The source of this supplier questionnaire pressure is Directive (EU) 2022/2555, known as NIS2. Beyond critical sectors such as energy, transport and health, it covers manufacturers of motor vehicles, machinery, electrical equipment and electronics, as well as food production and distribution. Entities classed as "essential" or "important" are responsible not only for their own networks but also for the security of their relationships with direct suppliers. That responsibility flows down the chain to you.

One distinction matters. For a typical non-EU manufacturer or service supplier, what binds you is your customer's contract rather than NIS2's administrative penalties, so the cost of a gap is usually not a fine but a lost order, a longer approval cycle or removal from the approved supplier list.

There is one exception where NIS2 applies to a non-EU firm directly: Article 26 of the Directive requires entities that are not established in the EU but offer certain digital services there, such as cloud computing, data centre, managed IT or managed security services, to designate a representative in the EU, which brings them into scope directly. If you provide services of that kind, have your position reviewed by legal counsel.

For general groundwork, our [SME cyber security checklist](https://digitalbridge.com.tr/en/blog/sme-cyber-security-checklist.html) is a good starting point; this guide focuses on what an EU customer will specifically ask. For the other side of the coin, assessing your own suppliers, see our guide to [third-party vendor security assessment](https://digitalbridge.com.tr/en/blog/third-party-vendor-security-assessment.html).

## What does it cost a supplier to be caught unprepared?

The figures explain why your EU customer is so strict about supplier security. Supplier-related breaches are no longer an exception:

> According to Verizon's 2026 Data Breach Investigations Report, breaches involving a third party rose 60% on the previous year to reach 48% of all breaches, and only 23% of third-party organisations fully remediated missing or improperly secured MFA on their cloud accounts. ([Verizon 2026 DBIR](https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf))

An NIS2-covered customer carries heavy exposure of its own. The [European Commission's NIS2 FAQs](https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive-faqs) state that essential entities face maximum fines of at least €10 million or 2% of worldwide annual turnover, and important entities at least €7 million or 1.4%, whichever is higher. The same source sets a 24-hour deadline for an early warning and 72 hours for an incident notification after the entity becomes aware of a significant incident. If you are slow to report an incident in your systems, you shrink the time your customer has to assess it and meet those deadlines.

The dominant threat to the supply chain is also clear. The EU Agency for Cybersecurity's [ENISA Threat Landscape 2025](https://www.enisa.europa.eu/sites/default/files/2026-01/ENISA%20Threat%20Landscape%202025_v1.2.pdf) found that ransomware accounted for 81.1% of cybercrime activity targeting EU organisations. A supplier whose production line is stopped by ransomware can stop the customer's assembly line too, which is why backup and recovery questions always sit near the top of the questionnaire. If you will use outside help for this preparation, the criteria for assessing a firm are in [choosing a cyber security company](https://digitalbridge.com.tr/en/blog/choosing-a-cyber-security-company.html).

## NIS2 Article 21: what exactly does your customer need from you?

Article 21 of the Directive requires in-scope entities to adopt at least ten risk-management measures and names supply chain security explicitly in point (d) ([NIS2 Directive, EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555)). Article 21(3) then requires them, when deciding on supply chain measures, to take into account each direct supplier's specific vulnerabilities, the overall quality of its products and its cyber security practices, including secure development procedures.

To take those factors into account, your customer has to collect the information from you, which is why the questions land on your desk. The table below shows how Article 21 headings typically translate into questions and evidence.

| NIS2 Article 21 heading | Typical question to the supplier | Evidence expected |
|---|---|---|
| (a) Risk analysis and security policies | Do you have a written information security policy, and when was it last reviewed? | Approved policy, risk register |
| (b) Incident handling | Within how many hours will you notify us of an incident? | Incident response procedure, contact list |
| (c) Business continuity and backups | Are backups isolated, and are restores tested? | Backup plan, latest restore test record |
| (d) Supply chain security | How do you assess your own subcontractors? | Supplier list, contract clauses |
| (e) Secure acquisition, development and vulnerability handling | How quickly are critical patches applied? | Patch log, scan report |
| (f) Assessing the effectiveness of measures | How do you check that your controls actually work? | Internal audit report, review record |
| (g) Cyber hygiene and training | Do staff receive regular security training? | Training attendance records |
| (h) Cryptography | Is our data encrypted in transit and at rest? | Configuration statement |
| (i) Human resources security, access control and asset management | When is a leaver's access removed? | Access procedure, asset inventory |
| (j) Multi-factor authentication | Is MFA mandatory for remote access and email? | Configuration screenshot |

Most of the Article 21 questions in the table map onto [ISO 27001 Annex A controls](https://digitalbridge.com.tr/en/blog/iso-27001-guide-for-smes.html), so a certified supplier already holds much of the answer. Without a certificate there is no need to panic: customers usually want proof that a control works before they want a badge.

## How do suppliers prepare for NIS2? A seven-step plan for non-EU firms

The seven-step NIS2 readiness sequence below is designed for preparing before the questionnaire arrives rather than scrambling afterwards. Every step should leave behind a document or record, because the customer assesses your evidence, not your answer.

1. **Define the scope.** Which EU customers are in scope of NIS2, what security clauses sit in their contracts, and where do you touch their data or systems?
2. **Write an incident notification procedure.** For your customer to meet its 24- and 72-hour obligations, you need a shorter internal target. Record who detects, who escalates and whom you call at the customer. Türkiye's data protection law, KVKK, has its own 72-hour breach notification duty, so the [KVKK breach reporting process](https://digitalbridge.com.tr/en/blog/data-breach-72-hours-kvkk.html) and the NIS2 flow can share one team.
3. **Tighten identity and access.** Make [multi-factor authentication](https://digitalbridge.com.tr/en/blog/multi-factor-authentication-business.html) mandatory for email, VPN and cloud admin consoles. Document that accounts belonging to leavers and former contractors are closed. If you run email and file sharing on SmartMail and SmartFiles within [Smart360](https://digitalbridge.com.tr/en/smart360.html), a leaver's access to every product is removed in a single action, and active sessions are listed with device details and can be ended remotely, which gives you concrete evidence to show a customer.
4. **Prove backup and recovery.** Isolated backups and regular [restore testing](https://digitalbridge.com.tr/en/blog/backup-restore-testing.html) are asked about almost every time. A signed test record is far more convincing than "we have backups".
5. **Put patching on the record.** Set target times for critical patches within a written [patch management process](https://digitalbridge.com.tr/en/blog/patch-management-process.html), log when they are applied and scan internet-facing systems regularly. For key customers, a periodic [penetration testing report](https://digitalbridge.com.tr/en/blog/penetration-testing-guide.html) is strong evidence.
6. **Separate the production network.** If PLCs, SCADA servers and machine PCs share a flat network with the office, that is exactly the scenario your customer fears most. Segmentation and control of remote maintenance access should come first in [OT security](https://digitalbridge.com.tr/en/blog/ot-security-scada.html).
7. **List your own suppliers.** Point (d) reaches one link further down: IT service providers, cloud platforms and machine builders with remote access. Keep one register of who can reach what and which security clause each contract contains.

The result is an evidence folder of policies, procedures, test records, training logs and access lists, ready for the next questionnaire.

## Common mistakes when meeting NIS2 supplier requirements

The first mistake with an NIS2 supplier questionnaire is leaving it to the IT manager alone. Many questions concern HR, procurement and production, and a form filled in from one person's memory will contradict itself at the first audit. The Directive also requires members of management bodies to follow cyber security training, so your customer may ask whether leadership is involved.

The second mistake is answering "yes" to everything. A customer will respect a "partially" backed by a realistic improvement plan far more than a "yes" that later proves false. The third is treating data protection as a separate world. If you process personal data about an EU customer's staff or end users, your personal data safeguards and [KVKK compliance steps](https://digitalbridge.com.tr/en/blog/kvkk-compliance-steps.html) belong in the same evidence folder.

## How Digital Bridge prepares suppliers for NIS2

Digital Bridge has served clients across Türkiye from Adana since 2013. We do not sell a ready-made "NIS2 package"; we start with discovery. In the first session we read your customer questionnaires and contract clauses with you and produce a gap analysis against the Article 21 headings. The result is a prioritised list showing which questions you can already answer with evidence, which can be closed quickly and which need investment.

After the gap analysis, in the second phase we close the technical gaps. Through our [cyber security consultancy](https://digitalbridge.com.tr/en/consultancy/cyber-security.html) we implement MFA, network segmentation, backup architecture, vulnerability scanning and an incident response procedure, and document each one so it can be shown to your customer. Where backups or server infrastructure are the weak point, our [cloud and infrastructure consultancy](https://digitalbridge.com.tr/en/consultancy/cloud-migration-infrastructure-consultancy.html) designs isolated backups and a recovery plan with you.

For suppliers using Digital Bridge's Smart360 products, part of the questionnaire evidence already exists. [SmartMail business email](https://digitalbridge.com.tr/en/smart360/smartmail.html) writes every meaningful action, such as creating a mailbox, granting access or changing a setting, to an audit log with the actor, time and IP address, and in [SmartFiles file management](https://digitalbridge.com.tr/en/smart360/smartfiles.html) the activity history can be exported as CSV with date, person, action and IP address. Records like these show a customer that access control actually works more convincingly than a screenshot.

We do not keep personal data in a separate silo. With our [data protection compliance service](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html) we combine the data inventory, access permissions and breach notification flow with NIS2 readiness in one set of documents, so you do not maintain two folders for two audits. Browse all our [cyber security and compliance guides](https://digitalbridge.com.tr/en/blog/topic/guvenlik-kvkk.html) for background.

Automotive suppliers receive these questionnaires more often than most. Because our [automotive supplier solutions](https://digitalbridge.com.tr/en/industry-solutions/automotive-suppliers.html) already cover production systems, customer portals and [EDI integration](https://digitalbridge.com.tr/en/blog/automotive-edi-integration.html), we plan security work without stopping the line, starting with a pilot area. If you want to place security inside a wider plan, our guide to [supplier digital transformation](https://digitalbridge.com.tr/en/blog/automotive-supplier-digital-transformation.html) offers a useful frame.

## Next step

If you have an EU customer questionnaire waiting for answers, or you would rather not wait for the next one, share it with us along with the security clauses in your contract. Together we will produce the gap analysis and confirm, in a written proposal, which step comes first and what the scope is. You can reach us through our [contact page](https://digitalbridge.com.tr/en/contact.html).

## Frequently Asked Questions

### Does NIS2 apply to companies based in Türkiye?

Usually not directly. NIS2 is an EU directive applied through Member States' national laws, and Türkiye is not a Member State. Non-EU entities offering cloud computing, data centre or managed IT services in the EU can, however, fall within scope directly under Article 26 by designating an EU representative. For a typical manufacturer or service supplier the effect is indirect: an NIS2-covered EU customer requests security measures and evidence from you through contracts, questionnaires and audits.

### What documents does an NIS2-covered customer usually ask suppliers for?

The most common requests are a written information security policy, an incident response and notification procedure, a backup plan with a restore test record, an access management procedure, proof of MFA configuration, staff training records and a list of your own suppliers. Some customers additionally ask for a penetration test report, vulnerability scan results or a certificate such as ISO 27001.

### Is ISO 27001 certification mandatory for NIS2 suppliers?

NIS2 does not require suppliers to hold any particular certificate. Customers want evidence that measures actually work, and ISO 27001 is a common way to present that evidence in one package, which makes questionnaires easier. A supplier without certification can still provide adequate assurance through policies, procedures and test records; the customer's own supplier policy usually decides what is acceptable.

### How quickly must a supplier report a cyber incident to its customer?

Your contract sets the deadline. Because an NIS2-covered customer must send an early warning within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident, it will usually ask suppliers for a shorter window. Your internal procedure should define every step and owner, from the person who spots the incident to the named contact at the customer.

### What drives the cost of NIS2 supplier readiness?

The main cost drivers are how mature your existing policies and records are, how many in-scope EU customers you serve, whether the production network is already separated from the office, the state of your backup infrastructure and whether you are aiming for a certificate such as ISO 27001. For most firms the first items are MFA, isolated backups, written procedures and network segmentation. The exact scope is set in a written proposal after the gap analysis.

### Where should a small supplier start with NIS2 readiness?

Start by mapping what each EU customer expects of you and where you touch their data or systems. Then focus on the topics asked most often and closed fastest: MFA, isolated backups with restore testing, a written incident notification procedure and a reliable process for removing access. Once those four are in place, you can answer a large share of questionnaire items with evidence.