NIS2 readiness for IT, software and managed service suppliers

You run infrastructure, support users, host applications or ship software for companies that are essential or important entities. If you provide managed services or managed security, you may be in scope yourself as an ICT service management provider, regardless of who your customers are.

Scope the NIS2 supplier-readiness assessment Check your domain now NIS2 scope check

Why the questions arrive

An IT supplier is the highest-leverage supplier a regulated company has: your access is their access. Questionnaires for IT vendors ask for depth that other suppliers never see, and the answers are checked against what your own domain and systems show from outside. A managed service provider with DMARC at none or an unpatched remote-access tool fails before the spreadsheet is opened.

What you are asked

The five questions this sector gets

Each with what counts as evidence. A yes without an artefact scores nothing.

Privileged accessHow technician accounts are issued, protected with MFA, logged, reviewed and removed; whether customer credentials are vaulted.
Remote monitoring and management toolsWhich tools you use, how they are patched, and what happened in the last vendor advisory.
Secure development and changeCode review, dependency updates, separated environments, and how a change reaches production.
Logging and incident responseWhat you log, how long you keep it, who watches, and your notification commitment to customers.
Your own suppliers and hostingData centres, cloud regions, sub-processors, and the security statements you hold for each.

Fix first

Four things to have before the next questionnaire

Cheap, mostly visible from outside, and present in nearly every questionnaire. The rest goes into a dated plan with an owner per item.

MFA everywhere privileged, with a documented exception list
Patch cadence for RMM and remote-access tools with evidence of the last cycle
DMARC at reject and a published security.txt
A customer-facing security statement that matches what your domain shows

Get the twelve-point checklist (PDF)Read the checklist article

The assessment

NIS2 supplier-readiness assessment

10 working days, fixed scope, written deliverables.

External reconnaissance, authenticated configuration review, email and domain authentication, cloud and hosting posture, and a staff phishing baseline. You receive a written report, a remediation plan ordered by risk, and an evidence pack mapped to the NIS2 themes your customer is asking about.

External attack-surface report
Email authentication
Server and cloud hardening
Web security headers
Remediation plan

Book the scoping call Full scope and method

Questions from this sector

Asked before, answered here

Are managed service providers in scope of NIS2 themselves?

ICT service management (business to business), which includes managed service and managed security providers, is an Annex I sector. Medium and large providers are in scope directly; smaller ones are reached through customers. The scope check covers both routes.

Our customers ask for ISO 27001 or SOC 2. Do we need them?

Some tenders require a certificate. Many customers accept evidence against the NIS2 themes while you decide. The assessment produces that evidence pack and tells you how far you are from a certification route.

Can you check our posture before a customer does?

Yes. The instant site check shows what the public internet reveals in seconds; the full assessment covers the inside in ten working days.

Other sectors

Suppliers in other regulated chains

Industry

NIS2 readiness for IT, software and managed service suppliers

The five questions this sector gets

Four things to have before the next questionnaire

NIS2 supplier-readiness assessment

Asked before, answered here

Suppliers in other regulated chains

Manufacturing and industrial suppliers

Logistics and transport suppliers

Healthcare suppliers

Professional services suppliers