What Is NIS2? Mapping Its Vendor Rules to Real Evidence

NIS2 is the EU cybersecurity directive that pulls thousands of mid-sized and critical-sector companies into formal risk management obligations, and buried inside it is a clause that changes how those companies have to treat their suppliers. It expects a buyer to look at what a vendor can actually show, and most vendors already publish that evidence somewhere: an ISO/IEC 27001 certificate, a SOC 2 report, a BSI C5 attestation. This explainer maps the NIS2 supply-chain clause to the specific evidence already sitting on vendor pages, rather than restating the directive's text line by line.

What is NIS2?

NIS2 is the European Union's second Network and Information Security directive, formally Directive (EU) 2022/2555. It replaces the original 2016 NIS directive and widens the net considerably: energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, public administration, space, postal services, waste management, food and manufacturing of certain goods all fall inside its scope once an entity meets the relevant size thresholds. Entities are classified as essential or important depending on sector and size, which determines how closely a national authority supervises them and how far it can fine them. For a fuller breakdown of the obligations that apply to a given vendor relationship, see what NIS2 asks of your vendors. The directive does not itself certify anyone. It tells in-scope organisations what outcomes they must achieve and leaves them to prove it.

What NIS2 asks of your vendors

Most of NIS2's text is about an organisation's own security posture: risk analysis, incident handling, business continuity, access control, encryption, multi-factor authentication. One clause reaches outside the organisation entirely. It requires essential and important entities to manage the security of their supply chain, including the relationships with direct suppliers and service providers. That is not a request for a signed attestation. Regulators expect a buyer to have genuinely assessed the supplier's own security practices, which in practice means asking for, reading and keeping a record of the evidence a vendor already publishes, rather than relying on a questionnaire answer alone.

Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures... including supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
— Directive (EU) 2022/2555, Article 21

Diagram mapping NIS2 Article 21 supply-chain requirements to ISO 27001, SOC 2 and C5 evidence types — How NIS2's supply-chain clause lines up with evidence vendors already publish.

Mapping the clause to the evidence vendors publish

The directive does not name ISO 27001, SOC 2 or any other framework. It leaves the choice of measure to the entity carrying out the risk assessment. In practice, a handful of public evidence types answer the supply-chain question most directly, and each one covers a different part of it rather than all of it at once.

NIS2 supply-chain question	What it is really asking	Closest public evidence	Where to check
Has the supplier assessed its own risk?	Scope, controls and surveillance history	ISO/IEC 27001 certificate and Statement of Applicability	/frameworks/iso-27001
Does the supplier manage its own vendors and subprocessors?	Evidence of a vendor risk programme, not just a policy	SOC 2 report covering vendor management, or ISO 27001 supplier controls	/regulations/soc-2-vendor-management
Can the supplier detect and report an incident?	Operating effectiveness of detection and response controls over a period	SOC 2 Type II report	/blog/how-to-read-a-soc-2-report
Does a cloud or infrastructure supplier meet a recognised national baseline?	An assessment against a published control catalogue	BSI C5 report	/frameworks/c5
Can the business keep operating through a disruption?	A tested continuity and crisis management capability	ISO 22301 certificate	/frameworks/iso-22301

No single document answers Article 21 on its own. Each evidence type covers one part of the supply-chain question.

31 Oct 2025
ISO 27001:2013 certificates lapsed: IAF MD 26 transition deadline; 4 Jul 2026
FedRAMP Certified became the official label: Consolidated Rules for 2026; Ready became legacy from 28 Jul 2026; 11
Frameworks listed on Intercom's trust centre: in the CertReports index on 2026-10-21

ISO 27001 is the closest fit, and the edition matters

Of the available framework types, ISO/IEC 27001 maps onto Article 21 most directly because it is built around a risk assessment and a Statement of Applicability, the same logic NIS2 asks a supplier to run internally. ISO/IEC 27001: vendors with public evidence lists which organisations hold current certificates, which scope they cover and which edition they were audited against. That last detail matters: a certificate still citing the 2013 control set is not current evidence, regardless of what the badge on a marketing page claims. The supplier-relationship clauses inside Annex A are the section a NIS2-driven procurement review should read first, and ISO 27001 Annex A: what ISO/IEC 27001 supplier controls asks of your vendors sets out what those clauses actually require a supplier to do.

SOC 2 reports and the vendor risk clause

SOC 2 answers a different part of the same question. Where ISO 27001 certifies a management system, a SOC 2 report describes an auditor's testing of specific controls over a period, which is closer to what Article 21's incident-handling and detection requirements are really asking about. The phrase "SOC 2 certified" is wrong for the same reason the index flags it: SOC 2 produces a report, not a certificate, and there is no registry to check it against. SOC 2 CC9.2: what SOC 2 vendor and business partner risk asks of your vendors walks through the specific criterion that covers a supplier's own vendor management programme, and how to read a SOC 2 report in 20 minutes explains how to check the report type and period before relying on it for a NIS2 file.

C5 and the European cloud layer

Where a supplier is itself a cloud or hosting provider operating in Germany or serving German public-sector buyers, BSI's C5 catalogue is the attestation that NIS2-driven reviews tend to ask for by name, because it was built for exactly this kind of infrastructure assurance. The card below shows how a multi-region cloud vendor lists C5 alongside other national cloud attestations on the same page. Look at the assurance type and period on the live listing itself rather than treating a badge alone as proof.

Zoom · Trust report

Collaboration · Public evidence as of 26 Oct 2026

Visit trust centre Full evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 18 vendor-stated.

10 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Zoom publishes or offers, as of 26 Oct 2026.

Standard contractual clauses · On request
AI and data use policy · On request

1Security practices

Public statements from Zoom, shown as statements, not attestations, as of 26 Oct 2026.

Penetration testing · report available

Zoom's public listing places BSI C5 alongside FedRAMP, GovRAMP, IRAP and ISMAP for regional buyers. Every line is a dated public record from the Data Privacy Framework list and Zoom's trust centre. A framework not shown means no public evidence was found, not that Zoom lacks it.CertReports

Reading a vendor's evidence against NIS2 in five steps

1
Confirm the relationship is in scope
Check whether the supplier handles data or systems that feed into a service covered by NIS2's definitions. Not every SaaS contract does.
2
Pull the published evidence first
Before sending a questionnaire, check the vendor's trust centre or framework pages for an existing ISO 27001 certificate, SOC 2 report or C5 attestation.
3
Check scope and edition, not just the badge
Read the certificate scope and the control-set edition. A badge image on a marketing page is not the same as a current certificate.
4
Match the report type to the question
A SOC 2 Type I shows controls were designed; a Type II shows they operated over a period, which is what an incident-handling question actually needs. See SOC 2 vs ISO 27001: what to ask vendors for for which to request.
5
Record gaps honestly
If no certificate or report is public, record it as no public evidence and follow up directly, rather than assuming silence means a pass.

Flowchart of five steps for checking a vendor's public evidence against a NIS2 supply-chain review — A five-step path from NIS2 obligation to a checked vendor record.

NIS2 and DORA, where the obligations overlap

Financial entities inside the EU often have to satisfy both NIS2 and DORA for the same supplier relationship, because DORA is the sector-specific regime that sits on top of NIS2's general one for banks, insurers and investment firms. Where NIS2 asks for proportionate supply-chain security measures, see DORA: what Digital Operational Resilience Act asks of your vendors for how it is more prescriptive about ICT third-party contracts, testing and, for providers large enough to matter systemically, a direct oversight designation. A supplier that already publishes ISO 27001 and SOC 2 evidence for a NIS2 review is not automatically covered for DORA's additional contractual and exit-plan requirements, so a financial-sector buyer should treat the two reviews as related but separate questions, not one.

People also ask

What is nis2?

NIS2 is Directive (EU) 2022/2555, the EU's updated cybersecurity law covering critical and important sectors such as energy, transport, health, digital infrastructure and public administration. It replaces the original 2016 NIS directive, widens the list of in-scope sectors and raises the baseline for risk management, incident reporting and supply-chain security. Its sector and entity-size breakdowns determine which obligations, including the vendor-facing ones, actually apply to a given organisation.

What is nis2 compliance?

There is no NIS2 certificate to hold, so NIS2 compliance means an in-scope entity has implemented the risk-management, incident-reporting and supply-chain measures its text requires, and can show evidence of this to a national authority. For suppliers, the closest public evidence is usually a current ISO/IEC 27001 certificate, a SOC 2 report or, for cloud infrastructure providers, a BSI C5 attestation, rather than any single compliance badge.

What is nis2 directive?

The NIS2 directive is the formal name for Directive (EU) 2022/2555, adopted in December 2022, which EU member states were required to transpose into national law. It sets minimum cybersecurity requirements for essential and important entities and gives national authorities powers to supervise and fine organisations that fail to meet them, including specific supply-chain security duties covering suppliers and service providers.

What is nis2 in cyber security?

In a cyber security context, NIS2 functions as a baseline risk-management law rather than a technical standard. It tells an organisation what outcomes it must achieve, such as managing supplier risk, detecting incidents and reporting them within set timeframes, but leaves the choice of control framework open. That is why ISO 27001, SOC 2 and sector attestations such as C5 show up as the practical evidence behind most NIS2 programmes.

What is nis2 and dora?

NIS2 and DORA are related but separate EU regimes. NIS2 sets general cybersecurity and supply-chain obligations across many sectors, while DORA applies specifically to financial entities and is more prescriptive about ICT third-party contracts, testing and oversight of critical providers. A financial-sector supplier can be in scope for both at once, and meeting one does not automatically satisfy the other.

NIS2EU cybersecurity lawsupply chain securityISO 27001SOC 2C5

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.