ICT supply chain security – vendor contracts and requirements
NIS2 requires management of supplier-related risk. We help build the security requirements into contracts and procurement procedures.
Scope of services
- Assessment of key ICT service and product suppliers.
- Security clauses: security level, incident reporting, subcontractors, audit rights.
- Security requirements in public procurement of ICT services and equipment.
- Contracts with cloud and managed security service providers.
Suppliers to essential entities
Companies that are not essential or important entities themselves but supply ICT services to them increasingly receive requirements derived from the Act. We help assess and negotiate them.
Frequently asked questions
Does an IT supplier have to meet KSC requirements?
Directly – only if it is an essential or important entity itself. Indirectly, the requirements reach it through contracts, because its customers must manage supply chain risk.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.