NIS2 Supply Chain Security: A Guide for Essential Entities

What exactly NIS2 and the KSC Act require

Article 21 of Directive (EU) 2022/2555 lists ten areas of risk-management measures. One of them is supply chain security, including relationships with direct suppliers and service providers. The Directive requires entities to take into account the vulnerabilities specific to each supplier and the overall quality of its cybersecurity practices.

Poland transposed the Directive with the Act of 23 January 2026, published in Journal of Laws 2026, item 252, in force since 3 April 2026. The Act requires an information security management system that covers a risk estimation policy, asset analysis and ICT supply chain security. Entities that met the conditions on the day the Act entered into force must meet the obligations of Chapter 3 by 3 April 2027.

From the perspective of an industrial plant, the notion of a supplier is wider than a company that delivers software. It covers the controller integrator, remote line service, the cloud provider, the maintenance contractor with a service laptop and the subcontractor who enters the site. Each of them can become an entry path into the IT or OT network.

• ICT and software providers, including cloud services and remote service
• integrators and manufacturers of OT components: controllers, panels, gateways, readers
• subcontractors with physical access to halls, switchrooms and server rooms
• managed service providers: monitoring, helpdesk, network maintenance

Why the board cannot leave the topic to procurement

Article 20 of NIS2 obliges management bodies to approve risk-management measures and oversee their implementation. Under the KSC Act, the head of the entity takes decisions on the information security management system, plans the funding and must complete mandatory annual cybersecurity training. Responsibility for suppliers is therefore part of the board's responsibility, not only of procurement.

The stakes are set in Article 34 of the Directive: fines of up to EUR 10 million or 2% of worldwide turnover for essential entities and up to EUR 7 million or 1.4% for important ones. The Polish provision applies the higher of the two amounts, and fines under Article 73(1)–(4) can be imposed for the first time two years after the Act entered into force, that is from 3 April 2028. The transition period does not remove the need to build evidence, because the first cybersecurity audit of an essential entity falls on the same date.

How to meet the obligation: six steps

The sequence below works in plants with hundreds of suppliers and a security team of a few people. Each step ends with a document that can be shown to an auditor.

Step 1. Inventory and register

Start with a list of all suppliers that touch systems, data or premises. The sources are contracts, invoices, access control, remote VPN accounts and the list of external companies. For each one, record the scope of the service, the responsible person on the entity's side and the type of access.

Step 2. Criticality classification

Divide suppliers into groups according to their impact on process continuity and data confidentiality. A simple split into critical, significant and other suppliers is enough if the criteria are described and applied consistently. A critical supplier is one whose failure or compromise stops a process or exposes confidential data.

Step 3. Supplier risk assessment

For the critical and significant groups, carry out an assessment: a questionnaire, a review of certificates and reports and, where needed, an audit. In an industrial environment the reference point is the ISA/IEC 62443 series: part 2-4 describes requirements for integrators and service providers, part 4-1 the secure product development lifecycle, and part 3-3 system requirements based on seven foundational requirements and security levels SL 1–4. The series is voluntary, but it is a recognised benchmark for assessment.

Step 4. Contract requirements

Turn the assessment findings into clauses: incident reporting within deadlines consistent with your own obligations, the right to audit, remote access rules, return or deletion of data and requirements for the supplier's subcontractors. The guide on contract clauses covers the details.

Step 5. Access control over time

A paper assessment does not replace ongoing control. Grant remote access for the duration of a task, use named accounts instead of shared ones, and link the physical permissions of external companies to a current training record and work permit.

Step 6. Review and reassessment

Reassess a critical supplier at least once a year and after every incident, change of owner, relocation of the service to another country or change of subcontractor. The result goes into the register with a date and an owner.

Evidence for the auditor: what to collect

An auditor does not ask whether the entity has good intentions toward its suppliers, but asks for traces. The first cybersecurity audit of an essential entity falls on 3 April 2028 and is then repeated at least once every three years. The set of documents that supports meeting the requirement should be ready earlier, because collecting it at the last minute exposes gaps.

The most commonly expected chain is: a supplier security policy, the register, classification, assessment results, a contract with the required clauses, records of changes and reviews, an access log and a record of training for external persons. For physical access, the evidence is a digital trail: training, permit, field check, with a date and the confirming person.

• supplier assessment policy and procedure approved by the head of the entity
• supplier register with criticality classification and owner
• completed questionnaires and evidence from critical suppliers
• contracts with clauses on incidents, audit and access
• record of annual reviews and post-incident decisions
• trail of training and permits of external companies entering the site

High-risk suppliers and legal uncertainty

The Act also contains provisions on high-risk suppliers, that is a procedure that designates a supplier as such and restrictions for entities that use its products. These provisions were covered by the President's application to the Constitutional Tribunal for subsequent review. According to verified sources there is no ruling yet, so it is reasonable to treat the provisions as binding while not basing purchasing decisions on a prediction of the judgment.

The practical conclusion: add a field for capital origin and processing location in the supplier register for critical suppliers, and describe how quickly a supplier can be replaced. Supplier risk assessment should also be supported by a list of alternatives, because the obligation to change may come from an administrative decision, not from a failure.

How a tool supports evidence for physical access

Part of the supply chain is people from external companies on the plant site. InnerWeb, a software producer from Bielsko-Biala, provides a training module with a register of companies and qualifications, and digital work permits with QR code checks in the field. This supports meeting the requirement for physical access and provides an audit record of who entered work, when and on what basis. The solution is independent of the client's existing systems and complements them.