Is your business NIS2-ready on vendor risk?

NIS2 — the EU’s Network and Information Security Directive 2 — reaches full enforcement for most organisations in October 2026. Article 21 lists supply chain security as a mandatory risk management measure, with direct obligations around vendor assessment, ongoing monitoring, and contractual protections.

Most businesses are exposed. Spreadsheets, annual questionnaires, and a reactive approach don’t satisfy what the directive now requires. The Hackett Group’s research found that only 20% of organisations monitor vendor risk continuously — and more than half take a reactive approach. That gap becomes a liability once enforcement begins.

When a regulator asks for evidence of your vendor risk programme, you need to produce it immediately. Not in two weeks. This checklist shows you exactly what they’ll ask for — and where most organisations fall short.