NIS2 and suppliers: coordinating contracts, security and directors’ responsibilities

Prepared by De Amicis & Petrova Law Firm · Updated 6 November 2026 · General information

A shield connects buildings and documents, illustrating cybersecurity across the supply chain. — Original illustration created using artificial intelligence.

Start by determining the business’s status

The NIS2 framework requires cybersecurity, organisation and contractual relationships to be coordinated. In Italy, the reference is Legislative Decree No 138/2024, which transposes Directive No 2022/2555. Before amending contracts, the business’s position must be established: sector, size, actual activities, any special criteria and communications received from the National Cybersecurity Agency.

Being a supplier to an NIS entity does not automatically mean being subject to all its public-law obligations. The customer may nevertheless require measures and information to manage its own supply chain risk. It is therefore necessary to distinguish obligations directly applicable to the business from commitments undertaken by contract, checking the content, addressee and commencement of each.

Security also concerns governance

Article 23 of the Decree assigns specific duties to the administrative and management bodies of essential and important entities: approval of arrangements for implementing measures, oversight, training and information about incidents. Outsourcing infrastructure or technical support does not discharge this role.

A useful organisational structure identifies who proposes measures, who decides, who monitors progress and what information reaches directors. Minutes, action plans and reports should describe actual decisions and checks. Merely collecting supplier certificates or declarations may not explain how risks relevant to the business’s services are managed.

Assessing the supplier and the specific service

Article 24 includes supply chain security among risk-management measures. It requires consideration of, among other things, specific vulnerabilities of direct suppliers and the quality of products and security practices. The assessment must be proportionate to exposure and possible consequences.

When preparing a contract, it is useful to describe which systems and data are involved, what access is granted and how much an interruption could affect operations. A storage service, maintenance with remote access and operational software do not necessarily present the same risk. This analysis leads to requirements, checks and priorities to be shared among technical teams, procurement, management and legal advisers.

Turning requirements into verifiable commitments

A clause imposing NIS2 compliance in general terms may leave operational issues unresolved. It is preferable to specify roles, service levels, security updates, access management, retention of evidence and how the customer verifies performance. Requirements must be compatible with the service purchased and the responsibilities actually assigned.

The contract should also address subcontracting, business continuity, recovery and termination of the relationship. It must be clear who returns data and documents, in what formats, within what times and how access is revoked. ENISA’s good practices emphasise managing suppliers throughout the relationship: oversight does not end with the initial questionnaire.

Incidents: coordinating communications and decisions

When an incident occurs, the customer must receive timely, usable information. The contract can define a contact person, alternative channels, minimum content for the initial notification and subsequent updates. The timeframes agreed with the supplier must allow the obligated entity to meet its own duties: simply copying a statutory deadline is insufficient without considering the time needed to collect and assess the data.

Article 25 governs notification of significant incidents to CSIRT Italia. Applicability and commencement must be checked against the entity’s status and the relevant implementing measures. Any personal data breach obligations must be assessed separately: addressees, requirements and content do not necessarily coincide with those under NIS. It is useful to establish a shared information-gathering process and separate decisions for each obligation.

Liability, checks and updates

Liability limits, warranties, insurance and contractual remedies must be consistent with the services and foreseeable damage. An indemnity does not replace the adoption of measures or remove obligations towards the authority. Even an audit right requires practical rules on notice, confidentiality, access and handling issues identified.

Existing contracts, a service inventory, risk analyses, technical documents and ACN communications are useful starting points for a review. The Firm can support business managers in defining responsibilities and clauses, coordinating with security specialists. Deadlines must be established for the individual case: one company’s timetable should not automatically be applied to another, particularly where the year of entry into scope differs.