Your supplier's cyber gap can become your NIS2 problem

Focus first on parties that can stop a core process, reach sensitive data or connect directly to your systems. Their safeguards belong in your own risk picture.

A small payroll provider can be more critical than a much larger office supplier. Size and contract value say little about operational dependency. Rank suppliers by what happens to your customers and employees when their service fails.

Ask for concrete controls, named contacts and tested response times. A certificate helps, but it does not replace evidence about the service you actually use.

Translate promises into operating agreements. How quickly will the supplier notify you, what information will you receive, who leads recovery and how can you retrieve your data if the relationship ends? If the answer is only best effort, your continuity plan must account for that.

Your supplier often depends on cloud platforms, identity providers, data processors and software components of its own. You do not need a complete map of the internet, but you do need to know where one failure could affect several critical services at once.

Ask critical suppliers which subcontractors support your service and how changes are communicated. Concentration risk deserves special attention. Five contracts can still represent one dependency when every provider runs on the same underlying platform.

Run a short exercise with one critical supplier. Simulate unavailable systems or stolen credentials and observe whether contact details, escalation routes and recovery assumptions still work. A ninety-minute exercise can reveal more than another questionnaire.

Close the loop by assigning every finding to an owner and date. Supplier risk management fails when reviews happen once during procurement and are never revisited as services, access and subcontractors change.