The NIS2 supplier scorecard

Each yes scores one point.

1. 1.Do the founders sign off a one-page risk register at least once a year? Risk analysis, art. 21(2)(a).
2. 2.Do we have a written security policy that management approved? Art. 21(2)(a) and art. 20(1).
3. 3.Do security alerts page a named person, day and night? Incident handling, art. 21(2)(b).
4. 4.Does our incident runbook name who decides whether an incident is significant? Art. 21(2)(b) and art. 23(3).
5. 5.Do we encrypt backups and copy them to an isolated account with deletion protection? Backups and continuity, art. 21(2)(c).
6. 6.Have we restored from backup, and timed it, in the last six months? Art. 21(2)(c).
7. 7.Do we keep a register of critical suppliers and what each one can reach? Supply chain security, art. 21(2)(d).
8. 8.Do we check a new critical supplier's security before we sign? Art. 21(2)(d) and art. 21(3).
9. 9.Do we define infrastructure in code and review every change? Secure development, art. 21(2)(e).
10. 10.Do dependency and secret scanning run on every change? Art. 21(2)(e).
11. 11.Do we follow a patch cadence and keep a record of it? Vulnerability handling, art. 21(2)(e).
12. 12.Do we check every quarter that the controls work, and file the results? Testing effectiveness, art. 21(2)(f).
13. 13.Does every staff member take security training at least once a year, with a record? Cyber hygiene and training, art. 21(2)(g).
14. 14.Has the management body taken security training? Art. 20(2).
15. 15.Do we encrypt data at rest and in transit everywhere, with keys we control? Cryptography, art. 21(2)(h).
16. 16.Does every human sign in through single sign-on, with least-privilege roles? Access control, art. 21(2)(i).
17. 17.Do we generate an inventory of accounts, identities, and data stores from the cloud APIs? Asset management, art. 21(2)(i).
18. 18.Do we enforce MFA on every human account? Art. 21(2)(j).
19. 19.Do admins use phishing-resistant MFA, such as passkeys or hardware keys? Art. 21(2)(j).
20. 20.Could we send an early warning within 24 hours of becoming aware of a significant incident? Reporting, art. 23(4)(a).

Under 14? I highly recommend a thirty-minute call with your cloud console on screen. I'll show which three gaps a regulated customer will spot first. Which question was hardest to answer with evidence?

These takeaways are an engineer's reading of the rules and the tools. I wrote them to help teams decide what to build. They aren't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.