The NIS2 directive (Network and Information Security Directive 2) is European legislation that requires organisations in critical sectors to demonstrate their cybersecurity. The directive came into force in 2024 and has a far wider scope than its predecessor.
What many smaller companies do not realise: even if you do not fall under NIS2 directly, supply chain responsibility can still oblige you to meet the requirements. Large organisations that do fall under NIS2 are responsible for the security of their suppliers. More and more clients set cybersecurity requirements for their suppliers, and NIS2 compliance is becoming a procurement condition.
NIS2
NIS2 applies directly to “essential” and “important” entities in 18 sectors, among them energy, transport, banking, healthcare, digital infrastructure and government. Companies in those sectors with more than 50 employees or more than 10 million euros in turnover fall under the directive.
But NIS2 plays a role even when your company is not in those categories. Article 21(2)(d) obliges companies under NIS2 to secure their supply chain. That means you, as a supplier, have to be able to demonstrate that you are secure.
The obligations
Article 21 of the NIS2 directive requires “appropriate and proportionate technical, operational and organisational measures”. The directive explicitly names:
There is also a reporting duty for significant incidents: an initial report within 24 hours, a full incident report within 72 hours.
Our contribution
Guardian and Sentinel are designed to support the NIS2 requirements that matter most to smaller companies in the supply chain.
01
Article 21 requires effectiveness assessments of security measures. Our automated vulnerability scans provide the technical evidence that you actively find and address vulnerabilities. Guardian: annually. Sentinel: every quarter.
02
As a supplier you have to show that you are secure. The services in Guardian and Sentinel help you demonstrate it: from email security to fake domain monitoring and vulnerability scans.
03
Website and domain protection, SSL/TLS monitoring and uptime monitoring safeguard the availability and integrity of your network and systems, core requirements of article 21.
04
DMARC, SPF and DKIM stop email being forged in your company name. That blocks attack vectors NIS2 addresses.
05
NIS2 requires cybersecurity awareness programmes. Security awareness training and phishing simulations give that obligation shape for your staff.
Please note
Orange Warriors delivers technical security measures that contribute to compliance. We do not issue certification and we are not a legal adviser. Whether you fully meet a guideline also depends on organisational measures, policy and documentation that fall outside our services.
NIS2 at the European Commission (digital-strategy.ec.europa.eu)FAQ
NIS2 applies to companies in 18 specific sectors with more than 50 employees or more than 10 million euros in turnover. Not sure whether you fall under it directly? We help you work it out in a free scan.
Possibly. If you supply a company that does fall under NIS2, that client can require your security level through their own NIS2 obligations. This is what we call supply chain responsibility. We see more and more clients setting it as a procurement condition.
For essential entities: up to 10 million euros or 2% of worldwide annual turnover. For important entities: up to 7 million euros or 1.4% of annual turnover.
We deliver technical measures that contribute substantially to NIS2 compliance. Full compliance also requires organisational measures, policy and documentation. We are not a legal adviser and we do not issue NIS2 certification.
Free scan
Guardian and Sentinel deliver the technical measures clients under NIS2 ask of you. We look at where you stand, free of charge.
