First announced: Cybersecurity and operational-resilience requirements increasingly address supplier and service-provider risks, including under EU frameworks such as NIS2.
Submitted by: NYBACS Compliance Desk
What changed
Businesses are expected to understand how key suppliers affect service continuity, data security, and incident response. Specific legal duties depend on the industry, jurisdiction, and whether the company falls within a regulated or designated category.
Who’s affected
Organisations relying on cloud, payment, payroll, software, logistics, or other providers that support critical operations or handle sensitive data.
Immediate actions
- Identify suppliers that support critical services or access sensitive data.
- Record the business impact if a supplier becomes unavailable.
- Review contracts for security, incident notification, and data-handling terms.
- Maintain recovery and exit plans for important services.
Practical note & timeline
NIS2 applies to entities within its scope, which depends on sector and other criteria. Businesses should confirm whether the directive and national implementing rules apply to them.
Source: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
