NIS2 supply chain: what happens between two questionnaires

A supplier questionnaire records how secure a supplier was on the day it was filled in. Your supply chain's security is decided on the other 364 days: by the IT provider that leaves its VPN gateway unpatched, the tax adviser whose domain can be spoofed, the logistics partner that turns up on a ransomware leak site. NIS2 requires you to account for exactly these weaknesses in every direct supplier. That means knowing them before the next questionnaire is due.

What NIS2 requires for the supply chain

The NIS2 Directive makes supply chain security a mandatory risk management measure. Article 21(2)(d) names it; Article 21(3) requires organisations to consider the vulnerabilities specific to each direct supplier and the quality of its cybersecurity practices. Nationally and by sector:

• Austria: Section 32(4)(d) NISG 2026, in force since 1 October 2026, adopts this wording, including the vulnerabilities of each supplier.
• Germany: Section 30(2) no. 4 of the BSI Act names supply chain security, in force since 6 December 2025.
• Digital providers such as cloud, data centre and managed service providers: under point 5.1.6 of the annex to Implementing Regulation (EU) 2024/2690, they monitor and evaluate changes in suppliers' cybersecurity practices, for example after significant incidents, and act where necessary.
• Financial sector: DORA covers ICT third-party risk in Articles 28 to 30.

ISO 27001 control A.5.22 is more specific: supplier security practices must be monitored, reviewed and evaluated regularly. None of these rules prescribes a tool or an interval. All assume you notice changes at a supplier when they happen.

Why the questionnaire alone falls short

A questionnaire is a dated self-declaration: it records what a supplier says about itself, once. It keeps its place in third-party risk management, because nobody sees processes, backups or training from outside. For the systems a supplier exposes to the internet, it has three gaps:

• It goes stale. In 2026, the US agency CISA added 283 vulnerabilities to its catalogue of known exploited vulnerabilities by early November, more than six a week (as of 3 November 2026). More than two dozen hit firewalls, VPN and remote access gateways, the systems service providers use to reach customer networks.
• It doesn't measure. "We patch promptly" is an answer, not a finding. No questionnaire tells you whether the provider's VPN gateway reports a vulnerable version.
• It doesn't scale. With a few hundred suppliers, one round a year is already a project, for you and for suppliers asked the same questions by many customers.

Verizon's 2026 Data Breach Investigations Report puts the risk in numbers: a third party was involved in 48 per cent of confirmed breaches, up from 30 per cent in the previous report.

What an outside-in rating shows, and what it doesn't

An outside-in rating, also called a security rating, measures what a supplier's internet-facing infrastructure reveals, without access to its systems or its involvement. It answers part of the questionnaire with a measurement, not a statement:

The last row is the key limit. A good grade means no obvious weaknesses from outside, not that the supplier is secure, and only what can be attributed to its domain is rated. The rating does not replace the questionnaire. It shows which supplier to ask, and when.

How to set up continuous supplier monitoring

Continuous supplier monitoring needs no big project, just six decisions you make once:

1. Start from procurement's list. The vendor list in your ERP beats any list from memory; what counts is each supplier's domain.
2. Rank by criticality. Does the supplier access your systems? Does it process confidential data? Would your operation stop without it? Two yeses make it critical.
3. Record the baseline. Change matters more than the absolute value: a supplier falling from B to D deserves more attention than one steady at C for a year.
4. Define triggers and owners. Triggers might be a new known exploited vulnerability, a leak-site listing or a D or F grade for a critical supplier; owners can be security, procurement or the business unit.
5. Review weekly. A fixed weekly slot is enough when alerts cover the urgent cases.
6. File the evidence. A monthly report with date, grade distribution and your responses to declines belongs in the ISMS.

What to do when a supplier gets worse

A worse rating is a reason to ask, not a verdict. How urgently you respond depends on the cause:

• Known exploited vulnerability: Send the supplier's security contact the finding with system, CVE and date, and agree a fix date. Until then, restrict its VPN accounts or API keys on your side.
• Ransomware leak-site listing: Treat it as a possible incident of your own. Establish which of your data the supplier holds, rotate shared credentials and check whether your own services are significantly disrupted. If they are, your reporting duty under NIS2 Article 23 may apply.
• Unprotected e-mail domain: Without an enforced DMARC policy, e-mails in the supplier's name are easier to forge, invoices with changed bank details included. Until the next review, have accounts confirm bank detail changes via a known phone number.

Record every response: who contacted whom and when, what the supplier answered and what you decided. This chain of finding, contact and decision shows you actually take your suppliers' vulnerabilities into account.

How blacklens.io takes over continuous monitoring

In blacklens.io, the Supply Chain Monitoring module handles the steps that take time: measuring, repeating, comparing. Your supplier has nothing to install or approve. The images show the demo workspace with fictional suppliers.

Import and rank suppliers

Under Supply Chain → Suppliers you add suppliers one by one, as a list or as a CSV file from procurement. URLs and e-mail addresses are reduced to the registrable domain, and a preview shows every entry before anything is added. Criticality (Low to Critical) and tags are set during import.

Rating and baseline

Each supplier gets a grade from A to F and a score from 0 to 100 across nine rating areas, from software patching to e-mail and DNS security. The first rating starts automatically and is the baseline; a new one follows every 7 days. Areas that cannot be measured do not count as 0. Every finding states what was found and how to fix it; pass it on as a CSV export or Supplier Report (PDF).

In the demo workspace, a managed service provider rated Critical, which runs the Microsoft 365 tenant, operates a VPN gateway with CVE-2024-3400, in the CISA KEV catalogue since April 2024. While the finding stands, the grade is capped at D. Without the cap, it would be a C.

Alerts and the weekly review

When a rating is worse than the last, the alert Supplier risk increased reports it by e-mail, push or to Microsoft Teams, Slack, Jira or ServiceNow. Triggers are a lower grade, a new known exploited vulnerability, a new critical finding or a ransomware leak-site listing. For Critical suppliers, severity rises to High. A falling score without a grade change raises no alert.

For the weekly review, the supplier list shows the grade distribution, the last seven days' changes and tiles such as At risk (grade D or F). BQL filters such as criticality = critical and kev_findings > 0 find critical suppliers with known exploited vulnerabilities. The ransomware watchlist also checks leak sites, about every 30 minutes.

Evidence

The Supply Chain Report summarises the last 30 days of the portfolio as a PDF, with changes, risk concentrations and required action, one-off or scheduled monthly to fixed recipients. With the rating and alert history, it provides evidence for NIS2 and DORA.

blacklens.io does not cover questionnaires, self-assessments or a supplier portal. Each workspace licence includes five suppliers, and the 14-day trial includes supplier risk rating. The outside view makes sure the next questionnaire asks the right questions.