kopik
Créer
Tech & produitVérifiée par Kopik: Sources officielles relues et réponses testées par Kopik

NIS2 supply chain security: supplier requirements and contract clauses

Supply chain security is one of the minimum measures of NIS2 Article 21. This page covers what entities must assess in their suppliers, what contracts should contain and what ENISA recommends.

Posez votre question

Compte gratuit requis

Chaque question est indépendante · 1 offertes par mois, puis avec l'abonnement.

Les réponses sont rédigées par un modèle de langage à partir des seuls documents de cette base, avec leurs sources numérotées. Elles peuvent être inexactes et ne constituent pas un conseil juridique, médical ou financier : vérifiez les sources avant toute décision importante.

What the Directive requires

Article 21(2)(d) covers supply chain security, including security aspects of the relationship between each entity and its direct suppliers or service providers. Under Article 21(3), entities must consider the vulnerabilities specific to each direct supplier, the overall quality of their products and cybersecurity practices, including secure development procedures.

At Union level, the Cooperation Group, with the Commission and ENISA, may carry out coordinated security risk assessments of critical ICT services, systems or product supply chains, taking into account technical and, where relevant, non-technical risk factors.

Supply chain policy and contracts under Regulation 2024/2690

For digital infrastructure and ICT service providers covered by the Implementing Regulation, a supply chain security policy must govern relations with direct suppliers. Selection criteria include suppliers' cybersecurity practices, their ability to meet specifications, the quality and resilience of their ICT products and services, and the ability to diversify supply and limit vendor lock-in.

Contracts should specify, where appropriate through service level agreements, cybersecurity requirements, staff training and background checks, prompt incident notification, a right to audit or receive audit reports, and an obligation to handle vulnerabilities.

Questions fréquentes

Which areas do ENISA's supply chain good practices cover?

ENISA groups them into five areas: strategic corporate approach, supply chain risk management, supplier relationship management, vulnerability handling, and quality of products and practices for suppliers and service providers. It recommends a corporate-wide supply chain management system based on third party risk management.

Why does ENISA stress supplier trust?

ENISA's 2021 analysis of supply chain attacks found that around 62% of attacks on customers took advantage of their trust in their supplier. In 66% of the incidents, attackers focused on the suppliers' code to further compromise targeted customers.

Is there practical guidance on evidence of compliance?

Yes. ENISA's Technical Implementation Guidance (June 2025) supports Regulation 2024/2690 with guidance, examples of evidence that a requirement is in place, and mappings to standards and national frameworks.

Pour les développeurs et les agents

Intégrer / API / MCP

Branchez cette base à Claude, Cursor, ChatGPT ou votre propre application. Chaque requête API ou MCP coûte 0,10 €, débitée de votre crédit Kopik (non facturée si rien n'est trouvé). Il vous faut une clé API : créez-la depuis votre tableau de bord.

MCP pour vos agents

Adresse du serveur MCP de cette base (outils ask_base et search_base) :

URL MCP
https://kopik.io/api/mcp?base=eu-nis2-cybersecurity
Claude Code, Cursor et autres clients
Claude Code
claude mcp add --transport http kopik-eu-nis2-cybersecurity "https://kopik.io/api/mcp?base=eu-nis2-cybersecurity" --header "Authorization: Bearer kpk_…"
Configuration JSON (mcpServers)
{
  "mcpServers": {
    "kopik-eu-nis2-cybersecurity": {
      "url": "https://kopik.io/api/mcp?base=eu-nis2-cybersecurity",
      "headers": {
        "Authorization": "Bearer kpk_…"
      }
    }
  }
}

API REST pour vos applications

mode vaut "answer" (réponse rédigée + sources) ou "passages" (passages bruts seulement). Ajoutez un maxPriceCents facultatif pour plafonner le prix : si la base coûte plus cher, l'appel est refusé sans rien débiter.

curl
curl -X POST https://kopik.io/api/v1/bases/eu-nis2-cybersecurity/query \
  -H "Authorization: Bearer kpk_…" \
  -H "Content-Type: application/json" \
  -d '{"question": "Votre question ici", "mode": "answer"}'

Pour commencer

  1. Créez une clé dans votre tableau de bord et rechargez votre crédit.
  2. Remplacez kpk_… par votre clé.
  3. Tout le détail (réponses, erreurs, exemples JS et Python) : documentation développeurs.