# Does NIS2 make us responsible for our cloud providers' security?

Not for running it, but for managing the risk it creates for you, if your company is covered by NIS2. Directive (EU) 2022/2555 lists supply-chain security, including the security aspects of relationships with direct suppliers and service providers, among the cybersecurity risk-management measures in Article 21. In practice that means knowing which cloud and SaaS providers your important services depend on, assessing their security, writing requirements into contracts, and planning for their failure or compromise. Cloud computing service providers are themselves listed in NIS2 as entities in the digital infrastructure sector, so many have their own obligations, which helps, but does not replace your assessment. Useful evidence from providers includes independent audit reports, certifications with a clear scope, incident notification commitments and exit terms. Keep a supplier register that names the data and services each one supports, and review it yearly and after incidents. National transpositions can add requirements or guidance; check your country's law and your authority's publications.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/does-nis2-make-us-responsible-for-our-cloud-providers

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [What do we do if a cloud or SaaS account is compromised?](https://netsenx.com/en/faq/what-to-do-if-a-cloud-account-is-compromised)
- [What is the shared responsibility model in the cloud?](https://netsenx.com/en/faq/what-is-the-shared-responsibility-model-in-the-cloud)
- [What is the difference between IaaS, PaaS and SaaS?](https://netsenx.com/en/faq/what-is-the-difference-between-iaas-paas-and-saas)
- [Does moving to the cloud make us safer?](https://netsenx.com/en/faq/does-moving-to-the-cloud-make-us-safer)
- [What does a network sensor see of our cloud and SaaS traffic?](https://netsenx.com/en/faq/what-does-a-network-sensor-see-of-cloud-traffic)