Suppliers
Assessment and tracking of cyber compliance for critical suppliers and service providers — the NIS2 requirement on supply chain security.
Supplier record
| Field | Content |
|---|---|
| Name, Category | Identification |
| Criticality | Critical · Important · Standard |
| Scope / service provided | What the supplier actually operates |
| Contact, Contract reference | Contractual traceability |
| Security clauses in the contract | Presence and content of cyber clauses |
| DPA signed | Data processing agreement |
| Compliance status | Compliant · To be checked · Non-compliant |
| Next audit | Date of the next assessment |
| Notes | Free text |
Link to EBIOS stakeholders
A supplier can be linked to an EBIOS stakeholder from workshop 3 of the open project. The two objects describe the same third party from two angles: one carries the contract and the audit, the other the ecosystem threat level.
Why this link is worth making
A stakeholder rated dangerous in EBIOS and a supplier marked "Compliant" with no security clause in the contract — that is an inconsistency neither module can see on its own.
If no project is open, or if workshop 3 has not been filled in, the selector stays empty — the supplier record is still saved.
The register is not tied to the project
Like the other NIS2 registers, it belongs to your account or your group, not to the analysis project.