When security duties reach you as a supplier: what to do first
Answer. When a client contract, a regulator notice, or a supply-chain audit tells you that security duties now reach you as a supplier, do not start with the technical fix. Identify which duty applies, read the deadline stated in the notice itself, preserve the relevant logs and configuration, and escalate internally before you draft any reply. The order matters more than the speed.
Basis
Directive (EU) 2022/2555 (NIS2) requires essential and important entities to manage security risks across their supply chain. In practice this means the entity you supply must impose contractual security requirements on you, review your measures, and in some cases require you to report incidents that affect its systems. The directive sets the EU-level framework; the exact duty that reaches you sits in the national law transposing it and, more immediately, in the contract clause your client relies on.
This is why the first document to read carefully is not the directive — it is the notice or clause your client sent you.
Practical consequence
A supply-chain security duty rarely arrives as an abstract obligation. It arrives inside a live contract, with a deadline that is usually shorter than the one you would expect from general practice. It can also open contractual audit rights, trigger a security questionnaire with a response window, or connect to a credit or penalty mechanism already built into the agreement. Treat the notice as time-sensitive from the moment it lands, not from the moment you finish assessing it.
What to do first
| Step | Action | Who does it |
|---|---|---|
| 1 | Read the trigger document in full — contract clause, client notice, or regulator letter | You, or whoever received it |
| 2 | Find the deadline stated in the document itself; do not assume a standard period applies | Compliance lead |
| 3 | Preserve logs, configurations, and any evidence tied to the event or the audit request | Technical owner |
| 4 | Escalate to whoever has authority to sign a response on behalf of the company | Management |
| 5 | Confirm scope — is the duty limited to one incident, or does it cover the full contract term | Contract owner |
| 6 | Respond in writing, within the stated deadline, through the channel named in the contract | Compliance lead |
Steps four and five run in parallel where possible. Waiting for scope to be fully confirmed before escalating internally is the most common cause of a missed deadline.
Who decides
Two different decision-makers sit behind this situation, and they answer different questions.
| Question | Decision-maker |
|---|---|
| Does your response satisfy the contract? | Your client, as the party that imposed the duty |
| Has your client met its own obligation under NIS2? | The competent national authority, if it reviews the client's supply-chain measures |
You are rarely the direct addressee of the regulator. You are the addressee of your client's contractual duty, which exists because the client is answerable to the regulator. Keep that distinction in the back of your reply: it changes what you need to prove, and to whom.
Where this situation forks
If a subcontractor or reseller sits between you and the client without a documented consent chain, the licensing question runs on a separate track — see When a sublicence appears without consent and the deadline.
If the same contract includes a service-level regime with financial consequences, a security event can trigger both duties at once — see When an SLA credit regime is triggered explained.
If the technology you supply sits on a patent family with its own procedural clock, that clock does not pause for a security notice — see When the opt-out window is closing on a family.
If your services connect to a digital asset platform and a related listing decision is pending, treat it as a separate procedure, not part of the security response — see When a listing is refused step by step.
What this page does not decide
This page does not tell you whether you fall within scope of NIS2 as a supplier — that depends on the size and sector of the entity you supply, and on the specific clause in your contract. It does not calculate financial exposure, and it does not replace a reading of the notice you actually received. Treat it as the order of operations, not as the assessment itself.
Verified
Checked against the current text of Directive (EU) 2022/2555 (NIS2). Where a national implementing act governs your specific duty, that act — not the directive — sets the exact deadline and the exact obligation.
Related publications
For the reporting clock that often runs alongside a supply-chain security duty, see When an incident report deadline is running in detail.
FAQ
What is the first step when security duties reach you as a supplier?
Read the document that triggered the duty in full, before drafting any response. The deadline and the scope of what is expected are usually stated there, not in general guidance.
Which deadline is already running?
Whichever deadline the notice, clause, or letter states directly. Contractual deadlines under a supply-chain security clause are frequently shorter than a general incident-response timeline, so do not assume a standard period.
Who decides, and on what evidence?
Your client decides whether your response satisfies the contract, based on the evidence and documentation you provide. The competent national authority decides only whether your client's own NIS2 obligation has been met, and it reviews the client's supply-chain measures, not your internal file directly.