What the law requires
The NISG 2026 has applied in Austria since 1 October 2026. It is based on the EU NIS2 Directive.
§ 32 (4)(d) NISG 2026 lists supply chain security as a minimum part of risk management. It covers relationships with direct suppliers and service providers. You must take four points into account:
- the specific vulnerabilities of each direct supplier,
- the overall quality of its products,
- its cybersecurity practices, including secure development,
- the results of coordinated EU risk assessments of critical supply chains.
Article 21(2)(d) and (3) of the NIS2 Directive set the same duty for all EU member states.
Measures must be appropriate and proportionate (§ 32 (1) and (3) NISG 2026). Risk, size and possible harm decide the effort.
Who is affected
The duty applies to essential and important entities. Whether your company is one follows from the law; legal advice helps.
Suppliers are usually not entities themselves. They still feel the duty: customers ask for evidence, questionnaires and contract clauses.
Six steps
- List your suppliersKeep a complete list with service, contact and domain. Without a list there is no control.
- Classify by riskWhich data does the supplier see? Does it access your systems? How fast can you replace it? This sets the depth of review.
- Set requirementsDecide per tier which evidence you require, for example certificate, questionnaire and emergency contact.
- Review and recordAssess answers and evidence. Record who reviewed what and when.
- Put it in the contractAgree incident reporting, audit rights and rules for subcontractors.
- Monitor continuouslyReview critical suppliers more often. Watch for expiring certificates and new vulnerabilities.
Questions to ask suppliers
A good questionnaire follows the ten minimum topics of § 32 (4) NISG 2026.
| Topic | Sample question |
|---|---|
| Risk analysis and security policies | Is there an approved security policy that is reviewed every year? |
| Incident handling | How quickly will you inform us of an incident that affects us? |
| Business continuity, backup and crisis management | Are backups stored separately and restores tested? |
| Supply chain security | Which subcontractors see our data, and in which country? |
| Acquisition, development and maintenance | How quickly do you install critical security updates? |
| Assessing effectiveness | Are there internal audits or external reviews of your measures? |
| Cyber hygiene and training | Are all staff trained at least once a year? |
| Cryptography and encryption | Is our data encrypted in transit and at rest? |
| Personnel, access control and assets | Is access removed at once when a person leaves? |
| Multi-factor authentication and secure communication | Is a second factor required for remote and admin access? |
What suppliers should prepare
- A current self-disclosure with contacts for security and incidents.
- Certificates such as ISO/IEC 27001 with scope and expiry date.
- A list of subcontractors with service and country.
- A short description of backup, emergency plan and updates.
- A contact for vulnerability reports, such as a security.txt file on the website.
- A clean public setup: email protection with SPF and DMARC, current website encryption.
Checklist: supply chain under NISG 2026
Tick off what is already in place.
- All suppliers listed with service, contact and domain.
- Each supplier classified by data, access, importance and replaceability.
- Evidence and questions defined per tier.
- Questionnaire aligned with the ten topics of § 32 (4) NISG 2026.
- Evidence filed with expiry date, reminder set before expiry.
- Incident reporting, audit rights and subcontractors covered in the contract.
- Critical suppliers reviewed more often than others.
- Each review recorded with date, result and person.
You may copy and adapt this list freely.
Frequently asked questions
Does the NISG 2026 apply to suppliers?
Directly only if the supplier is an essential or important entity itself. Indirectly yes: entities must consider the cybersecurity practices of their direct suppliers (§ 32 (4)(d) NISG 2026).
Since when does the NISG 2026 apply?
Since 1 October 2026 (BGBl. I Nr. 94/2025). Checked on 31 October 2026.
Do we have to review all suppliers equally?
No. The law requires appropriate and proportionate measures (§ 32 (1) and (3) NISG 2026). A risk-based classification is the usual way.
Does NIS2 apply in Switzerland?
The NIS2 Directive addresses EU member states. Swiss suppliers of EU customers still receive the same questions.
Sources
- NISG 2026, § 32 risk management measures, BGBl. I Nr. 94/2025, in force since 1 October 2026
- NIS2 Directive, Article 21(2)(d) and (3), Directive (EU) 2022/2555
Legal sources checked on 31 October 2026. Legal information, not legal advice. For your own case, please ask a professional. The German version is binding.