NIS2 ceases to be a compliance project of the future. It was effective as of January 2023 and EU member states had up to October 17, 2024 to implement it in their national legislation and NIS 1 was abolished as of October 18, 2024. Another indication that companies ought to treat NIS2 as an issue that is in operation, as opposed to a watchlist matter, is the fact that the European Commission also introduced targeted changes to enhance legal clarity in early 2026.
In the case of third party risk teams, it is a straightforward message. The review of the vendors cannot just end with a questionnaire, a policy pack, and an annual update. The directive covers additional areas, introduces real emphasis on risk management and incident reporting and brings cybersecurity responsibility nearer the boardroom. It also directly identifies supply chain security as a component of the greater cyber risk scenario.
That alters the types of questions that should be posed to vendors in 2026.
1. Does the Vendor Demonstrate a Real Risk Management Program?
The initial question will be, does the vendor demonstrate a real risk management program and not merely indicates the existence of a risk management program. The technical implementation guidance by ENISA identifies specific areas that the organizations could demonstrate they could, such as risk management, incident handling, business continuity and crisis management, supply chain security, access control, asset management, cryptography, and security training. In case a vendor claims to be ready to NIS2, it should be able to demonstrate that it has the controls documented, owned, and reviewed in practice.
2. Can the Vendor Detect and Report Incidents in a Timely Manner?
The second question is whether the vendor is able to detect and report the incidents in a timely manner. NIS2 reporting is staged. Large incidents need timely notification of incident, more detailed incident notification, and final notification, normally within one month. That is important as the slackness of one vendor can turn into your transparency. Unless they are able to give answers on what decides an incident to be material, how to escalate, or what information they can give during the first day, that is not a legal footnote. It is an operational risk.
3. Has the Vendor Taken Supply Chain Risk Seriously?
The third question is whether the vendor has taken supply chain risk into serious consideration within the internal environment. Most of the evaluations fail in this point. The question of whether a provider has security controls over its own systems or not is no longer sufficient. You must also know how it analyses subcontractors, dependencies, concentration risk, and even the vendor lock in. The guidance by ENISA specifically mentions the supply chain security and even considers such aspects as the jurisdiction of the supplier and the possibility of diversifying the source of supply where necessary.
4. Is Leadership Involved?
The fourth question is the issue of whether leadership is involved. NIS2 elevates the governance profile of cybersecurity, and that must transform what the buyers request in due diligence. An established vendor ought to demonstrate that the choices on security are not put in silo within the technical team. It should have executive ownership, reporting line and demonstration that major risks are being looked at at a level higher than operational. In cases where leadership is not present in the discussion process, the vendor risk teams tend to inherit more uncertainties than they can comprehend.
5. Is the Evidence Up to Date?
The fifth one is whether the evidence is up to date. Timing has always been one of the largest issues with vendor risk. A point in time evaluation can appear clean as the actual environment is already different. This is one of the reasons why NIS2 conversations move more towards sustained monitoring, more evidence-focused and more rapid validation loops. The question of whether this vendor passed review last year or not is not better in 2026. It is What can they prove at this moment?
The Real Shift
Not all companies that have the longest questionnaires will deal with NIS2 best. It is their duty to be able to relate regulatory requirements with actual vendor management. They are aware of what vendors are the most important and the evidence that needs to be gathered, how to monitor the changes in time and how to take immediate measures when an incident or control gap is observed. That is the actual change that NIS2 is causing. It is relocating the third party risk part of the paperwork to a dynamic aspect of cyber resilience.
By 2026, more than declarations should be requested by the third party risk teams. They are to demand evidence of incident preparedness, evidence of management, evidence of supply chain control and evidence that evidence remains up to date. That is no longer an overkill under NIS2. It is the standard.