NIS2 for Non-EU Suppliers: Why Customers Are Asking

The NIS2 Directive is the EU’s main law on cybersecurity for a wide range of sectors. It applies to many medium and large organisations in areas such as energy, transport, health, digital infrastructure, manufacturing and public administration. It is a directive, so each EU country turns it into national law.

If your company is based in India and supplies software or services to these organisations, NIS2 probably does not apply to you directly. It still matters, because your customers have to manage security risk in their supply chain, and you are part of that chain. This guide explains why the questions are arriving and how to answer them well.

1. Why your customers are asking

NIS2 requires the organisations in scope, called essential and important entities, to take appropriate measures to manage cybersecurity risk. Supply chain security is one of those measures. Organisations are expected to consider the security of their direct suppliers and service providers, including how those suppliers develop and maintain their products and services.

In practice, that means your European customers need to show that they have assessed you. They send questionnaires, ask for evidence and add security terms to contracts. Their management may also be personally accountable for overseeing cybersecurity under the national laws that implement NIS2, which tends to make these reviews more careful than before.

Even customers outside the strict scope may follow the same approach, because NIS2 is shaping what good practice looks like across Europe. A clear, prepared answer is useful well beyond the organisations the directive names.

NIS2 makes supply chain security your customer’s duty, and your customer will share part of that duty with you.

2. What expectations flow down

Each customer interprets its duties in its own way, and national laws differ in detail. Check your own contracts rather than assuming. In general, suppliers can expect questions and terms in a few areas.

Security practices come first. Customers want to know how you manage access, protect data, patch systems, develop software securely and monitor for threats. They may ask for a description of your information security management system or a recognised certification such as ISO 27001.

Incident handling is next. NIS2 sets reporting duties for the entities in scope, so they need fast information when something affects them. Expect contract terms on how quickly you will notify them, what you will tell them and how you will cooperate during an investigation.

Vulnerability handling matters too. Customers may ask how you find and fix vulnerabilities in your products, how you tell customers about them and whether you test regularly. A recent penetration test and a clear vulnerability disclosure process help here.

Finally, expect questions about your own suppliers. If you rely on cloud platforms or subcontractors to deliver the service, your customer may ask how you manage them in turn.

Some customers may also ask you to take part in their own exercises or reviews. Agree in advance what level of involvement you can offer, so that the request does not arrive as a surprise during a busy week.

3. How to answer well

Start by identifying which customers are likely to fall under NIS2, based on their sector and size. Ask them directly if you are unsure. That tells you where the detailed questions will come from.

Prepare a clear security summary that covers your practices in plain language: governance, access control, data protection, secure development, monitoring, incident response, vulnerability management and supplier management. Keep it factual and current, and update it after significant changes.

Agree a sensible position on incident notification. Your customers need speed and clear information, while you need terms you can actually meet. Decide what you can commit to, make sure your internal process supports it, and practise it.

Independent assurance makes answers easier to accept. An ISO 27001 certificate or a SOC 2 report gives customers something recognised to rely on. A regular vulnerability assessment and penetration test shows that you look for weaknesses rather than waiting for them to be found.

Treat these requests as an opportunity. Suppliers that answer clearly and quickly become easier to buy from, which matters when customers are reviewing many vendors at once.

Keep a record of what you have told each customer. Different customers ask in different ways, and answers can drift over time. A shared answer library, owned by the people who run the controls, keeps every reply consistent and true.

If European customers are sending you NIS2 questions, our regulatory audits team and ISO 27001 consulting team can help you prepare clear, honest answers. We are happy to talk.