You are expected to manage the security risks that come from your suppliers and service providers. Attacks increasingly arrive through a trusted supplier. NIS2 asks you to assess suppliers, set requirements in contracts and follow up on them.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- List the suppliers with access to your systems or data
- Add security and incident notification clauses to contracts
- Review critical suppliers at least once a year
Making it stick
Start with the ten suppliers that would hurt most if they were compromised. The rest can follow a lighter process. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.