Habit 05 of 18
Know what you have
A list of key suppliers
You know which suppliers hold your data or run your systems.
Your suppliers can be your weakest point. Customers covered by NIS2 must look at their suppliers, so expect to be asked about yours.
Switch it on in the map Counts towards 7 articles, controls and categories
§1 How to do it
How a small firm does it
- List the suppliers that hold your data or run your systems, such as IT support, cloud, payroll and accounts.
- Mark which ones are critical: you could not work without them.
- Note what each one holds or does, and whether a contract covers security and data protection.
- Review the list once a year.
Evidence that shows it
- The supplier list with what each holds and how critical it is
- Data processing agreements for suppliers that handle personal data
Ireland: NCSC Ireland guidance on supply chain applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(d) Supply chain security · supports
supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers
Supply chain security is named in this measure, and Article 21(3) asks you to consider each direct supplier. You cannot do either without a list.
Read Art 21(2)(d) on EUR-Lex
General Data Protection Regulation 1 item
-
Art 28 Contracts with processors · supports
the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures
Knowing which suppliers hold personal data tells you which ones need a processor contract and sufficient guarantees. The list on its own is not the contract.
Read Art 28(1) on EUR-Lex
ISO/IEC 27001:2022 2 items
-
A.5.19 Security with suppliers · subset
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control asks you to manage security risks from suppliers. Knowing who they are is the first part.
About ISO/IEC 27001:2022 on ISO -
A.5.20 Security in supplier contracts · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
You need to know your key suppliers before you can put security terms in their contracts.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 3 items
-
GV.OC Understanding your organisation's context · supports
GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated
Listing the suppliers you rely on is a practical way to understand the services your business depends on.
Read GV.OC-05 on NIST -
GV.SC Supply chain risk · subset
GV.SC-04: Suppliers are known and prioritized by criticality
Knowing your suppliers, and which ones are critical, is this outcome almost word for word.
Read GV.SC-04 on NIST -
ID.AM Asset management · supports
ID.AM-04: Inventories of services provided by suppliers are maintained
A supplier list that records what each supplier provides is an inventory of supplier services.
Read ID.AM-04 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.