{"id":713,"date":"2026-09-17T09:00:00","date_gmt":"2026-09-17T09:00:00","guid":{"rendered":"https:\/\/3rdcomply.com\/blog\/?p=713"},"modified":"2026-08-18T11:10:57","modified_gmt":"2026-08-18T11:10:57","slug":"blog-nis2-third-party-risk-article-21","status":"publish","type":"post","link":"https:\/\/3rdcomply.com\/blog\/2026\/09\/17\/blog-nis2-third-party-risk-article-21\/","title":{"rendered":"NIS2 and Third-Party Risk: What Article 21 Actually Requires\u00a0\u00a0"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>What You&#8217;ll Learn<\/strong>\u00a0<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Who NIS2 applies to and how scope is\u00a0determined\u00a0<\/li>\n\n\n\n<li>What Article 21 specifically requires for supply chain security\u00a0<\/li>\n\n\n\n<li>Which sectors face the most pressure\u00a0<\/li>\n\n\n\n<li>The most common gaps NIS2 auditors are finding\u00a0<\/li>\n\n\n\n<li>How to close those gaps in your vendor security program\u00a0<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The EU&#8217;s Network and Information Security Directive, NIS2, is one of the most significant expansions of cybersecurity regulation in recent years.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most of the conversation around NIS2 and third-party risk focuses on what organizations must do to secure their own systems: risk management measures, incident reporting obligations, and governance requirements.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But&nbsp;there&#8217;s&nbsp;a dimension of NIS2 that receives far less attention, and that catches many organizations off guard when they start looking closely at what the directive&nbsp;requires.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 makes you responsible for your supply chain. Your vendors, suppliers, and service providers included, not just your own systems.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s&nbsp;what that means in practice.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Who NIS2 Applies To<\/strong>\u00a0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 significantly expanded the scope of its predecessor. The directive applies to organizations in the EU and organizations outside the EU that provide services within it, across a broad range of sectors.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Essential entities<\/strong>&nbsp;(subject to stricter supervision): energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Important entities<\/strong>&nbsp;(subject to lighter-touch supervision): postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thresholds matter too. For most sectors, NIS2 applies to medium-sized and larger organizations,&nbsp;generally those&nbsp;with 50 or more employees or annual turnover exceeding 10 million euros. Some sectors have no size threshold.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If&nbsp;you&#8217;re&nbsp;uncertain whether your organization is in scope, the starting point is your national competent authority. Each EU member state has designated authorities responsible for NIS2 oversight in their&nbsp;jurisdiction.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What NIS2 Article 21 Actually Requires for Supply Chain Security<\/strong>\u00a0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Article 21 of NIS2 requires entities in scope to implement &#8220;appropriate and proportionate technical, operational and&nbsp;organizational&nbsp;measures&#8221; to manage cybersecurity risk.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Subsection 2(d) specifically includes: &#8220;supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.&#8221;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This language is consequential.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It means that your NIS2 compliance&nbsp;isn&#8217;t&nbsp;limited to your own systems and processes. It extends to the security posture of the vendors and service providers you rely on. If a vendor you depend on has inadequate security measures, and that leads to an incident affecting your organization, your organization bears responsibility for not having managed that supply chain risk adequately.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ENISA, the EU Agency for Cybersecurity, has published guidance clarifying that supply chain security under NIS2 includes assessing the security practices of suppliers. This covers their software development practices, access controls, data protection measures, and incident response capabilities.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>&#8220;We sent them a questionnaire&#8221;<\/em> is not, on its own, a satisfactory defense.\u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What NIS2 Means for Your Vendor Security Program<\/strong>\u00a0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The practical implication of NIS2&#8217;s supply chain requirements is that vendor security can no longer be treated as a secondary consideration or an annual checkbox exercise.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s&nbsp;what regulators are looking for when they assess vendor security programs under NIS2:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Evidence of systematic risk assessment.<\/strong>&nbsp;Not just a list of vendors, but documented evidence that&nbsp;you&#8217;ve&nbsp;assessed the security posture of your supply chain in a structured, risk-based way. This includes&nbsp;identifying&nbsp;which vendors&nbsp;represent&nbsp;critical dependencies and applying proportionate scrutiny to them.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Security requirements in supplier agreements.<\/strong>&nbsp;Contractual obligations that require vendors to&nbsp;maintain&nbsp;appropriate security&nbsp;standards,&nbsp;notify you&nbsp;of incidents within defined&nbsp;timeframes, allow for audits, and manage their own subcontractors&#8217; security. These provisions need to be in place before an incident, not negotiated after one.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ongoing monitoring.<\/strong>&nbsp;Point-in-time assessments are a starting point. NIS2 expects ongoing oversight, not a review that happens in Q4 and then gets filed until next year. The risk profile of your supply chain changes continuously, and your program needs to reflect that.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Incident notification from suppliers.<\/strong>&nbsp;If a vendor experiences a security incident that affects your organization, or could affect your organization, you need to know quickly.&nbsp;Your contracts should specify how quickly vendors must notify you, and you should have a process for acting on that notification.&nbsp;<\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><strong>The Sectors Under the Most NIS2 Supply Chain Pressure<\/strong>&nbsp;<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">While NIS2 applies across a wide range of sectors, some face particularly acute supply chain risk.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Financial services.<\/strong>&nbsp;Financial organizations often have deeply integrated technology supply chains: cloud providers, payment processors, data analytics firms, and fintech integrations. DORA, which runs alongside NIS2 for financial entities, adds further specificity to third-party ICT risk requirements.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Healthcare.<\/strong>&nbsp;Patient data handled by vendors creates significant exposure. Healthcare organizations often have complex ecosystems of medical device vendors, records management providers, and clinical software suppliers.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Digital infrastructure and ICT service management.<\/strong>&nbsp;These organizations are&nbsp;often&nbsp;part of other organizations&#8217; supply chains, meaning they face both upstream obligations to their customers and downstream requirements to manage their own suppliers.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Energy and utilities.<\/strong>&nbsp;Critical infrastructure with complex operational technology supply chains and significant consequences if a breach causes disruption.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Common Gaps NIS2 Auditors Are Finding in Vendor Security Programs<\/strong>\u00a0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Based on early enforcement activity and regulatory guidance&nbsp;emerging&nbsp;from member states, the most common gaps in vendor security programs assessed against NIS2 include:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Incomplete vendor registers.<\/strong>&nbsp;Organizations that&nbsp;don&#8217;t&nbsp;have a complete,&nbsp;maintained&nbsp;picture of their supply chain, including indirect dependencies and critical subcontractors, are starting from a flawed foundation.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Lack of risk-based prioritization.<\/strong>&nbsp;Treating all vendors identically, regardless of the sensitivity of data they access or the criticality of their service,&nbsp;doesn&#8217;t&nbsp;satisfy a proportionality standard.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Self-reported answers without verification.<\/strong>&nbsp;Collecting questionnaires that are never cross-referenced against documentation or independent evidence.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>No monitoring between reviews.<\/strong>&nbsp;Annual assessments with nothing in between. This approach&nbsp;doesn&#8217;t&nbsp;demonstrate&nbsp;ongoing oversight. It&nbsp;demonstrates&nbsp;periodic checkbox completion.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Missing contractual provisions.<\/strong>&nbsp;Existing vendor contracts that predate NIS2 often lack the security requirements, audit rights, and incident notification obligations the directive now requires.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Close the Gaps in Your NIS2 Vendor Security Program<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your organization is in scope for NIS2 and your vendor security program has some of these gaps, the remediation path is structured.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Start with your vendor&nbsp;to register.<\/strong>&nbsp;Make it complete and&nbsp;accurate. Include direct suppliers and, for critical dependencies, their significant subcontractors.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tier by criticality.<\/strong>&nbsp;Identify&nbsp;your critical suppliers: those whose failure or compromise would most significantly&nbsp;impact&nbsp;your operations or your customers. These receive the deepest scrutiny and the most robust contractual requirements.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Move from self-report to evidence.<\/strong>&nbsp;For critical vendors, questionnaire answers should be supported by documentation: SOC 2 reports, penetration testing summaries, and certification&nbsp;audit reports.&nbsp;Build this into your assessment process.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Update your contracts.<\/strong>&nbsp;Work with legal to ensure new and renewed vendor contracts include NIS2-aligned security requirements. Prioritize critical vendors for contract review.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Build in monitoring.<\/strong>&nbsp;Establish processes for staying aware of significant changes in your vendors&#8217; risk profiles between formal assessments, including breach monitoring, certification tracking, and defined triggers for out-of-cycle reviews.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Document everything.<\/strong>&nbsp;When a supervisory authority asks to see your supply chain security program, your documentation is your evidence.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>The Bigger Picture on NIS2 and Third-Party Risk<\/strong>\u00a0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 reflects a broader regulatory consensus: organizations can no longer treat their security perimeter as ending at their own front door.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The supply chain is part of the attack surface. Regulators across the EU and across frameworks globally have recognized this. The organizations that adapt their vendor security programs to reflect it&nbsp;won&#8217;t&nbsp;just be better positioned for regulatory compliance.&nbsp;They&#8217;ll&nbsp;be better protected against the breach pattern that keeps appearing in incident reports.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Third-party risk is everyone&#8217;s risk now.<\/strong>\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Frequently Asked Questions About NIS2 and Third-Party Risk<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Who does NIS2 apply to?<\/strong>&nbsp;NIS2 applies to organizations in the EU, and non-EU organizations providing services within the EU, across two categories: essential entities (energy, transport, health, banking, digital infrastructure, and others) and important entities (manufacturing, food, postal services, digital providers, and others). Size thresholds&nbsp;generally apply, with most sectors covering organizations of 50 or more employees or 10 million euros in annual turnover.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What does NIS2 Article 21 require for supply chain security?<\/strong>&nbsp;Article 21 subsection 2(d) requires organizations to implement measures addressing supply chain security, including security-related aspects of relationships with direct suppliers and service providers. This means organizations must assess,&nbsp;monitor, and manage the security of their vendors, not just their own internal systems.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Does NIS2 apply to non-EU companies?<\/strong>&nbsp;Yes. Non-EU organizations that provide services to entities within the EU, or that&nbsp;operate&nbsp;within EU-regulated sectors, may fall under NIS2 obligations depending on their activities and the member states in which they&nbsp;operate.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What happens if a vendor breach causes a NIS2 incident?<\/strong>&nbsp;If a vendor&#8217;s security failure leads to an incident affecting your organization, NIS2 holds your organization responsible for not having adequately managed that supply chain risk. This is why contractual security requirements, pre-contract due diligence, and ongoing monitoring are essential, not optional, elements of NIS2 compliance.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How is NIS2 different from DORA for financial services?<\/strong>&nbsp;NIS2&nbsp;sets out&nbsp;the broader cybersecurity framework across sectors. DORA applies specifically to financial entities and adds more detailed requirements for managing ICT third-party risk, including mandatory contract provisions, concentration risk assessment, and oversight of critical third-party providers. Financial entities must satisfy both.&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><em>3rdComply helps organizations build vendor security programs that meet NIS2 supply chain requirements, from risk-based vendor assessment through continuous monitoring and documentation. If your program needs to get NIS2-ready,\u00a0we're\u00a0ready to help.<\/em>\u00a0<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>What You&#8217;ll Learn\u00a0 The EU&#8217;s Network and Information Security Directive, NIS2, is one of the most significant expansions of cybersecurity regulation in recent years.&nbsp; Most of the conversation around NIS2 and third-party risk focuses on what organizations must do to secure their own systems: risk management measures, incident reporting obligations, and governance requirements.&nbsp; But&nbsp;there&#8217;s&nbsp;a dimension &#8230; <a title=\"NIS2 and Third-Party Risk: What Article 21 Actually Requires\u00a0\u00a0\" class=\"read-more\" href=\"https:\/\/3rdcomply.com\/blog\/2026\/09\/17\/blog-nis2-third-party-risk-article-21\/\" aria-label=\"Read more about NIS2 and Third-Party Risk: What Article 21 Actually Requires\u00a0\u00a0\">Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":714,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"class_list":["post-713","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>NIS2 and Third-Party Risk: What Article 21 Requires<\/title>\n<meta name=\"description\" content=\"NIS2 makes you responsible for your vendors&#039; security, not just your own. Here is what Article 21 requires, which organizations it applies to, and what your vendor security program needs to include to stay compliant.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1, noarchive\" \/>\n<link rel=\"canonical\" href=\"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NIS2 and Third-Party Risk: What Article 21 Requires\" \/>\n<meta property=\"og:description\" content=\"NIS2 makes you responsible for your vendors&#039; security, not just your own. Here is what Article 21 requires, which organizations it applies to, and what your vendor security program needs to include to stay compliant.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21\" \/>\n<meta property=\"og:site_name\" content=\"Blog 3rdcomply\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-17T09:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/08\/3rdComply-blogs-22.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"3rdComply Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"3rdComply Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/2026\\\/09\\\/17\\\/blog-nis2-third-party-risk-article-21\\\/\"},\"author\":{\"name\":\"3rdComply Admin\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb35af9c18abb4a214b43923eb82e2df\"},\"headline\":\"NIS2 and Third-Party Risk: What Article 21 Actually Requires\u00a0\u00a0\",\"datePublished\":\"2026-09-17T09:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/2026\\\/09\\\/17\\\/blog-nis2-third-party-risk-article-21\\\/\"},\"wordCount\":1675,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/3rdComply-blogs-22.png\",\"articleSection\":[\"Compliance\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/2026\\\/09\\\/17\\\/blog-nis2-third-party-risk-article-21\\\/\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21\",\"name\":\"NIS2 and Third-Party Risk: What Article 21 Requires\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/3rdComply-blogs-22.png\",\"datePublished\":\"2026-09-17T09:00:00+00:00\",\"description\":\"NIS2 makes you responsible for your vendors' security, not just your own. Here is what Article 21 requires, which organizations it applies to, and what your vendor security program needs to include to stay compliant.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#primaryimage\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/3rdComply-blogs-22.png\",\"contentUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/3rdComply-blogs-22.png\",\"width\":1280,\"height\":720,\"caption\":\"What NIS2 Article 21 actually requires for third-party and supply chain security.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/nis2-third-party-risk-article-21#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NIS2 and Third-Party Risk\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/\",\"name\":\"Blog 3rdcomply\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#organization\",\"name\":\"Blog 3rdcomply\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/cropped-3rdcomply-logo.png\",\"contentUrl\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/cropped-3rdcomply-logo.png\",\"width\":1476,\"height\":511,\"caption\":\"Blog 3rdcomply\"},\"image\":{\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb35af9c18abb4a214b43923eb82e2df\",\"name\":\"3rdComply Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g\",\"caption\":\"3rdComply Admin\"},\"url\":\"https:\\\/\\\/3rdcomply.com\\\/blog\\\/author\\\/alya\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NIS2 and Third-Party Risk: What Article 21 Requires","description":"NIS2 makes you responsible for your vendors' security, not just your own. Here is what Article 21 requires, which organizations it applies to, and what your vendor security program needs to include to stay compliant.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1","archive":"noarchive"},"canonical":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21","og_locale":"en_US","og_type":"article","og_title":"NIS2 and Third-Party Risk: What Article 21 Requires","og_description":"NIS2 makes you responsible for your vendors' security, not just your own. Here is what Article 21 requires, which organizations it applies to, and what your vendor security program needs to include to stay compliant.","og_url":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21","og_site_name":"Blog 3rdcomply","article_published_time":"2026-09-17T09:00:00+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/08\/3rdComply-blogs-22.png","type":"image\/png"}],"author":"3rdComply Admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"3rdComply Admin","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#article","isPartOf":{"@id":"https:\/\/3rdcomply.com\/blog\/2026\/09\/17\/blog-nis2-third-party-risk-article-21\/"},"author":{"name":"3rdComply Admin","@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/person\/bb35af9c18abb4a214b43923eb82e2df"},"headline":"NIS2 and Third-Party Risk: What Article 21 Actually Requires\u00a0\u00a0","datePublished":"2026-09-17T09:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/3rdcomply.com\/blog\/2026\/09\/17\/blog-nis2-third-party-risk-article-21\/"},"wordCount":1675,"commentCount":0,"publisher":{"@id":"https:\/\/3rdcomply.com\/blog\/#organization"},"image":{"@id":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#primaryimage"},"thumbnailUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/08\/3rdComply-blogs-22.png","articleSection":["Compliance"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#respond"]}]},{"@type":"WebPage","@id":"https:\/\/3rdcomply.com\/blog\/2026\/09\/17\/blog-nis2-third-party-risk-article-21\/","url":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21","name":"NIS2 and Third-Party Risk: What Article 21 Requires","isPartOf":{"@id":"https:\/\/3rdcomply.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#primaryimage"},"image":{"@id":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#primaryimage"},"thumbnailUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/08\/3rdComply-blogs-22.png","datePublished":"2026-09-17T09:00:00+00:00","description":"NIS2 makes you responsible for your vendors' security, not just your own. Here is what Article 21 requires, which organizations it applies to, and what your vendor security program needs to include to stay compliant.","breadcrumb":{"@id":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#primaryimage","url":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/08\/3rdComply-blogs-22.png","contentUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/08\/3rdComply-blogs-22.png","width":1280,"height":720,"caption":"What NIS2 Article 21 actually requires for third-party and supply chain security."},{"@type":"BreadcrumbList","@id":"https:\/\/3rdcomply.com\/blog\/nis2-third-party-risk-article-21#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/3rdcomply.com\/blog\/"},{"@type":"ListItem","position":2,"name":"NIS2 and Third-Party Risk"}]},{"@type":"WebSite","@id":"https:\/\/3rdcomply.com\/blog\/#website","url":"https:\/\/3rdcomply.com\/blog\/","name":"Blog 3rdcomply","description":"","publisher":{"@id":"https:\/\/3rdcomply.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/3rdcomply.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/3rdcomply.com\/blog\/#organization","name":"Blog 3rdcomply","url":"https:\/\/3rdcomply.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/05\/cropped-3rdcomply-logo.png","contentUrl":"https:\/\/3rdcomply.com\/blog\/wp-content\/uploads\/2026\/05\/cropped-3rdcomply-logo.png","width":1476,"height":511,"caption":"Blog 3rdcomply"},"image":{"@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/3rdcomply.com\/blog\/#\/schema\/person\/bb35af9c18abb4a214b43923eb82e2df","name":"3rdComply Admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/89bbd999f531f3c9baae50351f2903ff5eb6b023441032e887f868105af2b47d?s=96&d=mm&r=g","caption":"3rdComply Admin"},"url":"https:\/\/3rdcomply.com\/blog\/author\/alya\/"}]}},"_links":{"self":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts\/713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/comments?post=713"}],"version-history":[{"count":1,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts\/713\/revisions"}],"predecessor-version":[{"id":715,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/posts\/713\/revisions\/715"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/media\/714"}],"wp:attachment":[{"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/media?parent=713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/categories?post=713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/3rdcomply.com\/blog\/wp-json\/wp\/v2\/tags?post=713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}