[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-d":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-d","Article 21(2)(d)","Supply chain security (Article 21(2)(d))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (d) requires measures for supply chain security, including security aspects of relationships between the entity and its direct suppliers or service providers. Article 21(3) adds that entities should consider supplier specific vulnerabilities, product quality and suppliers' secure development practices.\n\n**In practice.** The entity inventories its suppliers, ranks them by criticality, assesses their security, includes security and incident notification clauses in contracts and monitors them over time. Results of coordinated EU supply chain risk assessments are taken into account where relevant. Evidence includes the supplier register, assessments, contract terms and monitoring records.\n\n**Common gaps.** Many entities rely only on questionnaires and do not cover managed service providers or software suppliers deeply enough. Contracts with existing suppliers often predate NIS2 and lack the needed clauses.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]