Vendorapp › NIS2
Is your business NIS2-ready on vendor risk?
NIS2 makes supply chain security a legal obligation. Most businesses aren’t ready. Download the free checklist and find out exactly where your gaps are.
Free, no credit card required · 35-point checklist, all Article 21 areas · Used by founders, CISOs, and compliance teams
Why this matters
Supply chain security is no longer optional. It’s a legal obligation.
*Source: The Hackett Group, TPRM Performance Study
NIS2, the EU’s Network and Information Security Directive 2, reaches full enforcement for most organisations in October 2026. Article 21 lists supply chain security as a mandatory risk management measure, with direct obligations around vendor assessment, ongoing monitoring, and contractual protections.
Most businesses are exposed. Spreadsheets, annual questionnaires, and a reactive approach don’t satisfy what the directive now requires. The Hackett Group’s research found that only 20% of organisations monitor vendor risk continuously, and more than half take a reactive approach. That gap becomes a liability once enforcement begins.
When a regulator asks for evidence of your vendor risk programme, you need to produce it immediately. Not in two weeks. This checklist shows you exactly what they’ll ask for, and where most organisations fall short.
Want the full picture first? Read the NIS2 supply chain security guide: who is in scope, what Article 21 requires, and how it maps to DORA, ISO 27001 and SOC 2.
What’s inside
10 sections covering every area NIS2 regulators will examine.
- Vendor Register & InventoryComplete, classified, current.
- Vendor Risk AssessmentCyber, ESG, sanctions, exposure.
- Continuous MonitoringOngoing oversight, not point-in-time.
- Contractual ProtectionsSecurity clauses, DPAs, audit rights.
- Vendor Onboarding ProcessDue diligence before access.
- Vendor Offboarding ProcessAccess revocation, data return.
- Incident Response (Third-Party)You within 24 hours of a vendor breach.
- Governance & AccountabilityNamed owner, board awareness.
- AI & Emerging Technology RiskNew audit focus area.
- Audit ReadinessEvidence on demand, not in two weeks.
Get the checklist
Get the free NIS2 Vendor Risk Readiness Checklist.
35 actionable items. Know your gaps before the auditor does.
No spam. No sales calls. Unsubscribe any time.
The checklist and Vendorapp’s readiness scoring are tools to help you prepare for NIS2 and DORA. They’re guidance, not legal advice, and don’t guarantee compliance. Responsibility for meeting your regulatory obligations stays with you, and Vendorapp isn’t liable for any resulting fines or penalties.
About Vendorapp
We automate everything on this checklist.
Vendorapp was built by people who managed vendor risk at tier-one financial institutions, and got tired of the tools available not being good enough. Automated sanctions screening across five global lists, one-click risk assessments, smart contract management, and audit-ready reports, in a single platform.
Nine ways Vendorapp sorts it. Tap one to see how.
Start free on Vendorapp.
No credit card required.