# What does NIS2 supply-chain security mean in practice for a small company?

It means managing the cyber-security risks that come from your suppliers and service providers as part of your own risk management. Directive (EU) 2022/2555 lists supply-chain security among the measures in its Article 21, including the security of relationships with direct suppliers and service providers. In practice, for an entity in scope: know which suppliers have access to your systems or data, assess how critical each one is, require basic security measures and incident notification in contracts, limit and control their access, and review all this regularly. If you supply an entity in NIS2 scope, expect to be asked for similar evidence even if NIS2 does not apply to you directly. National transpositions can add detail, so check your own country's law. NetSenX does not assess suppliers. It shows what their access does on your monitored network: connections, lateral movement, scanning and beaconing from the hosts they use, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/what-is-nis2-supply-chain-security-for-a-small-company

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/blog/2026-10-08_supplier-access-risk

## Related questions

- [How would we notice that a former employee's device is still connecting?](https://netsenx.com/en/faq/how-would-we-notice-an-ex-employees-device-still-connecting)
- [How can we tell if a stolen password is being used?](https://netsenx.com/en/faq/how-to-detect-a-stolen-password-being-used)
- [Should administrators use separate accounts for admin work?](https://netsenx.com/en/faq/should-admins-use-separate-accounts-for-admin-work)
- [What is privileged access management (PAM), and do we need it?](https://netsenx.com/en/faq/what-is-privileged-access-management)
- [Can network monitoring see attacks on accounts and the directory?](https://netsenx.com/en/faq/can-network-monitoring-see-identity-attacks)