Critical suppliers and NIS2
the method to manage third-party risk without losing your life to it, when you're on your own

Why NIS2 forces you to look beyond your own security

The NIS2 directive doesn't just ask you to secure your own systems. It explicitly requires you to assess and monitor the security of your supply chain: your IT service providers, software vendors, hosting providers, and integrators. In other words, the scope of your responsibility no longer stops at your own information system.

This isn't an abstract requirement. The 2025 CESIN barometer confirms it with a clear figure: a third of cyber incidents in France originate from a partner or supplier, not from the victim itself.

The conclusion is simple to state and hard to apply: you can no longer settle for securing your own perimeter. You also need to know, at all times, who your critical suppliers are and what level of trust you can place in them.

The real problem: qualifying dozens of suppliers, alone, with no tooling

On paper, the approach seems obvious: list your suppliers, assess their security level, prioritize actions. In practice, for a solo CISO at an SME or mid-market company, that's exactly where it gets stuck. A mid-sized organization easily works with dozens of critical providers: hosting provider, business-line software vendors, integrators, IT subcontractors, sometimes external firms with access to sensitive data. Sending a security questionnaire to each one, going through the answers, following up, and keeping it all up to date is a full-time job that no one has the bandwidth for on top of everything else.

The result: most solo CISOs simply give up. Not for lack of conviction, but because the perceived scale of the task discourages starting it at all. Supplier risk then remains a blind spot, documented nowhere, until an incident reveals it — at the worst possible moment.

The good news is that NIS2 does not require auditing all your suppliers with the same depth. It requires an approach proportionate to risk. And a proportionate approach always starts with the same question: among all these suppliers, which ones truly deserve your attention first?

The method: prioritize before you audit, in 4 steps

The most common mistake is wanting to assess everything at once, with the same level of rigor for every supplier. The method that works, even alone, relies on the opposite: sort before you dig deeper.

1. 1. List without filtering. Pull the complete list of your IT providers and software vendors, without judging them at this stage. A simple spreadsheet is more than enough to start: name, service provided, and the type of data or systems the supplier has access to.
2. 2. Classify by criticality, not contract size. A small provider with access to your production infrastructure is more critical than a large supplier that touches nothing sensitive. Three criteria are enough to quickly rank each line: access to sensitive or personal data, access to systems critical to your business, and how easily you could replace them if something went wrong.
3. 3. Focus your effort at the top of the list. The 10 to 15% most critical suppliers deserve a real security questionnaire and regular follow-up. For the rest, a simple declaration or a standard contractual clause is enough for now — not ideal, but clearly defensible under a risk-proportionate approach.
4. 4. Keep the inventory alive, not a frozen annual audit. The FortiSIEM episode makes the point well: what matters isn't having audited your suppliers six months ago, it's being able to answer, within minutes, the question "do we — or any of our providers — use this tool?" the day a critical flaw hits the news. An inventory you update with every new contract beats an exhaustive audit you never redo.

Where to start this week, even with a simple spreadsheet

You don't need a tool or a budget to get started. Three actions are enough to move this topic off the "someday" list:

• Block out one hour, no more, to draft the raw list of your IT providers from your contracts and recurring invoices. Don't aim for perfect completeness on the first pass.
• Apply the three-criteria grid (sensitive data, critical systems, ease of replacement) to each line. Thirty seconds per supplier is enough for a first sort.
• Send a short first questionnaire to the 3 to 5 suppliers that stand out as the most critical. Don't aim for perfection the first time around: an imperfect version sent this week beats an ideal version you keep postponing.

This is exactly the approach we recommend to our CISO clients who manage their security scope alone: a deliberately rough version at first, refined afterward, rather than a perfect audit that never arrives. The goal isn't perfection from day one — it's getting off dead center.

In summary

NIS2 requires assessing the security of your supply chain, and the 2025 CESIN barometer explains why: a third of cyber incidents in France come from a partner or supplier. For a solo CISO, the right answer is not to audit every provider in depth, but to classify them by criticality so effort goes where it counts, with an inventory kept continuously up to date rather than a frozen audit in a binder.