What does NIS2 supply-chain security mean in practice for a small company?
It means managing the cyber-security risks that come from your suppliers and service providers as part of your own risk management. Directive (EU) 2022/2555 lists supply-chain security among the measures in its Article 21, including the security of relationships with direct suppliers and service providers. In practice, for an entity in scope: know which suppliers have access to your systems or data, assess how critical each one is, require basic security measures and incident notification in contracts, limit and control their access, and review all this regularly. If you supply an entity in NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. scope, expect to be asked for similar evidence even if NIS2 does not apply to you directly. National transpositions can add detail, so check your own country's law. NetSenX does not assess suppliers. It shows what their access does on your monitored network: connections, lateral movement, scanning and beaconing from the hosts they use, on every plan.
Read next
Related questions
- How would we notice that a former employee's device is still connecting?
- How can we tell if a stolen password is being used?
- Should administrators use separate accounts for admin work?
- What is privileged access management (PAM), and do we need it?
- Can network monitoring see attacks on accounts and the directory?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
← All 45 questions on Zero trust, identity and segmentationAll topics