What does NIS2 say about supply chain security?
That entities in scope must manage the security risks that come from their suppliers and service providers. Article 21(2)(d) includes supply chain security, covering the security-related aspects of relationships between each entity and its direct suppliers or service providers, and Article 21(3) requires entities to take into account the vulnerabilities specific to each direct supplier, the overall quality of products and suppliers' cybersecurity practices, including secure development procedures. Article 22 adds coordinated EU risk assessments of critical supply chains. In practice: keep a list of suppliers with access to your systems or data, rank them by risk, ask the higher-risk ones for evidence, write security and incident-notification clauses into contracts, limit and monitor their access, and review yearly. NetSenX shows what suppliers' remote sessions do on your network and alerts if they spread to other devices.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.