NIS2 supply chain security
Assess, monitor and evidence your supplier risk for NIS2
CyberRank rates your suppliers and their suppliers from public, outside-in signals, reassesses them every night, and turns the results into reports and an Assurance Statement your customers and auditors can verify.
10 years of IISRI and CyberRank experience in Third-Party Risk Management and Supply Chain Risk Management
Outside-in ratings complement your internal audits and supplier questionnaires; they do not replace them.
- Supplier AHighB
- Supplier BCriticalC
- Supplier CMediumA
Illustrative example
What NIS2 asks of your supply chain
The EU's NIS2 Directive extends cybersecurity duties to the supply chain. Organisations in scope are expected to manage cybersecurity risk, and that includes the security of their relationships with direct suppliers and service providers.
Supplier risk has to be assessed, not assumed.
That means looking at the vulnerabilities and security practices of each direct supplier.
Leadership is accountable.
Management is expected to approve how cybersecurity risk is handled and to oversee it.
Measures must fit the risk.
Effort should be proportionate to the organisation's exposure and size, and to how likely and how severe an incident would be.
NIS2 applies through each member state's national law, so scope, requirements and penalties vary by country. Check the legislation where you operate and take legal advice where you need it.
Why supplier reviews leave gaps
Supply chain attacks work because a supplier's weakness becomes your exposure. Most supplier reviews still rest on questionnaires, which leaves four gaps.
Self-reported.
A questionnaire records what a supplier says about itself, and your review waits until it answers. CyberRank rates from public signals, so you do not wait.
Point-in-time.
A supplier's posture can change the week after an annual review, and nobody hears about it until the next one. CyberRank reassesses every night.
Blind below the first tier.
Your suppliers' own suppliers are rarely visible, though their weaknesses travel up the chain. CyberRank cascades risk through the chain: fourth-party risk flows into each supplier's risk, and suppliers' risk into your combined supply-chain score. A supplier's own rating stays separate from the chain behind it, so a strong grade does not hide a risky chain.
No business context.
A list of findings does not tell you which supplier would stop a critical service if it failed. Impact tiers and a heat map put the critical suppliers first.
What sits behind each supplier rating
A rating is only useful if you can see what it is made of. CyberRank builds each one from public signals and shows the findings behind it, so you can see where a supplier is exposed and decide what to do about it.
Supplier rating
Security BBPrivacy A
Illustrative example
The main domain and the subdomains you select are scanned for known vulnerabilities, with findings sorted by severity. Cloud hosting location is recorded alongside.
Email security
PassDKIM and DMARC settings show how well a supplier's email domain is protected against spoofing.
Leaked credentials
ReviewExposed credentials linked to a supplier's domain are checked and reported, and a separate Credential Leak Report is available.
Data breaches
TrackedBreaches involving a supplier are tracked. When monitoring is on, a new breach raises an event.
Data residency and jurisdiction
Outside your rulesYou list the legal jurisdictions and hosting countries you allow. Suppliers outside them lose points in your view.
Privacy policy, terms and conditions and detected certifications such as ISO 27001 and SOC 2 are reviewed, with GDPR indicators checked.
Fourth parties
TrackedA supplier's own suppliers are shown, with their ratings where available.
Quantum-crypto exposure
BetaAn early check on a supplier's cryptography exposure. It is in Beta.
AI use
BetaAn early check on how a supplier uses AI. It is in Beta.
Each signal feeds the supplier's rating, and the rating feeds your combined supply-chain score, so a weak spot in one place shows up where it matters.
A CyberRank rating is a posture indicator under a published method. It is not a certification, an audit opinion or a guarantee against breach.
How CyberRank helps you assess, monitor and manage supplier risk
An independent rating for every vendor you add.
Enter a website or company name. CyberRank assesses the vendor from public signals and returns one rating from AAA to D, with separate Security and Privacy sub-ratings. No access to the vendor's systems is needed, and you do not wait for a questionnaire to come back.
Priority based on what each supplier means to you.
Set an impact tier for each vendor: Critical, High, Medium or Low. CyberRank combines it with breach likelihood to give a risk level and a risk heat map, so priority goes to the vendors that matter most, not just the lowest-rated ones.
Fourth-party risk management.
See each vendor's own suppliers, with their ratings where available. CyberRank also suggests related organisations as auto-discovered vendors; you confirm or reject each one.
One combined supply-chain risk score.
CyberRank rolls up your own risk, your vendors and their fourth parties into one score. Direct vendors count at distance 1 and fourth parties at distance 2, with risk dampened by distance. You choose how much weight vendors carry, on a scale of 1 to 5. The tree roll-up is aligned with ISO 31000.
- Supplier AB
- Fourth partyC
- Supplier BA
Risk heat map
Breach likelihood →↑ Impact
Illustrative example
Where CyberRank fits in your NIS2 programme
| NIS2 area | What you need to show | How CyberRank supports it |
|---|---|---|
| Supplier risk assessment | What you need to showYou have assessed each direct supplier's vulnerabilities and security practices | How CyberRank supports itOutside-in rating with Security and Privacy sub-ratings; questionnaires with evidence upload; Certificate Compliance |
| Proportionate, risk-based measures | What you need to showYour effort matches each supplier's criticality | How CyberRank supports itImpact tiers, risk levels and heat map; baselines per vendor category |
| Ongoing monitoring | What you need to showYou notice when a supplier's posture changes | How CyberRank supports itNightly reassessment; events for rating changes, new breaches and privacy-policy changes; side-by-side review |
| Supplier incident and breach notification | What you need to showYou hear when a supplier has an incident or breach | How CyberRank supports itMonitoring raises an event when a breach involving a supplier is found; optional email alerts; Darknet and Credential Leak Reports |
| Supply-chain visibility | What you need to showYou understand the risk your suppliers carry from their own suppliers | How CyberRank supports itFourth-party view; combined supply-chain risk score; data residency rules |
| Management oversight | What you need to showLeadership can see and approve the approach | How CyberRank supports itNon-technical Management Report; rating history |
| Evidence for audits | What you need to showYou can show what you did and when | How CyberRank supports itCyber Risk Report, Credential Leak Report, published methodology, Assurance Statement; public API and webhooks |
This table shows where CyberRank supports NIS2-related work. It is not a legal mapping or a compliance determination.
The Assurance Statement: supply-chain evidence anyone can verify
When every vendor in your programme meets your baseline, you can issue an Assurance Statement: a PDF attestation, issued under the Independent Information Security Rating Institute (IISRI®), stating that your organisation's management system has been found to be in accordance with the vendor risk management requirements of the standard you select, or regulation like NIS2 and DORA.
Assurance Statement
Issued under IISRI®
Rating
Example Organisation B.V.
Example Street 1, 0000 XX Example City
has been found to be in accordance with the vendor risk management requirements in
ISO/IEC 27001:2022
Scope: controls 5.21 and 5.22
- Statement no.
- EXAMPLE-0000
- Issued:
- DD Month YYYY
- Valid until:
- DD Month YYYY
- Verification code:
- EXAMPLE-CODE
Reflects a point-in-time methodology. Does not warrant compliance before or after the statement date.
Statement verification
Valid
- Organisation
- Example Organisation B.V.
- Issued
- DD Month YYYY
- Valid until
- DD Month YYYY
- Rating
- A
Illustrative example
What it covers
Today you can issue it against ISO/IEC 27001:2022, scoped to control 5.21 (Managing information security in the ICT supply chain) and control 5.22 (Monitoring, review and change management of supplier services), a natural bridge to NIS2's supply chain security measure.
Who uses it
Organisations in scope for NIS2
Show customers, partners and auditors that you manage vendor risk against defined supply-chain controls.
Suppliers to regulated customers
If you sell to organisations in NIS2 sectors, attach the statement to tenders and due-diligence packs to show how you manage your own suppliers. It describes your vendor risk management; it is not an assessment of your own security.
How to obtain it
Reach full vendor compliance.
The option unlocks only when your vendor compliance rate is 100% and no vendor is non-compliant.
Confirm your details.
Confirm your legal name and address and choose the standard. The statement text shows your total number of vendors and your compliance rate.
Download the PDF.
It carries your legal name and address, the standard and scope, a unique statement number, issue and valid-until dates, a rating stamp, a QR code and a verification code.
How it is verified
Anyone can scan the QR code or enter the verification code on the public verification page. It shows whether the statement is Valid or Expired, the organisation, the dates and the rating. No login is needed.
Validity and limits
A statement is valid for one month from issue. It reflects a point-in-time methodology and does not warrant compliance before or after the statement date. It is not a NIS2 or ISO/IEC 27001 certification, and it is not an audit opinion.
Since 2016
10 years of Third-Party and Supply Chain Risk Management
IISRI, together with CyberRank, has 10 years of experience in Third-Party Risk Management and Supply Chain Risk Management, helping organisations gain visibility into the cybersecurity and privacy risks that come from their vendors, and manage them. That experience shows in how the platform works:
A published method.
A points-based model: a baseline pool of 360 points, deductions across ten categories, and credits for verified certifications, in four steps: Observe, Rate, Score Risk, Combine. The methodology overview and the in-app Rating Guide explain each one.
Aligned with the standards you report against.
Designed in line with ISO 31000, ISO/IEC 27001, 27701 and 42001, NIST SP 800-30 and 800-53, DORA and NIS2.
Business context, not just findings.
Impact tiers put priority on the suppliers your critical services depend on.
Visibility past the first tier.
Fourth-party ratings and a combined supply-chain score show risk that a single vendor rating can miss, and the risk cascades from fourth parties through your suppliers to you.
A CyberRank rating is a posture indicator under a published method. It is not a certification, an audit opinion or a guarantee against breach.
See it in practice: which vendors were still exposed two days into PHP2Shell.
Also working on DORA?
DORA is the EU's regulation on digital operational resilience for financial entities, and it covers how they manage ICT third-party risk. CyberRank supports that work with the same assessment, monitoring and reporting. Impact tiers use DORA-style criticality definitions:
T1Critical
failure directly halts a critical service
T2High
essential, can be temporarily mitigated
T3Medium
supports normal operations
T4Low
minimal operational impact
Assessment
20 credits ($20)
per vendor, one-off
Monitoring
30 credits ($30)
per vendor per month, 1-month minimum
NIS2 questions, answered
What is NIS2, and who must comply?
NIS2 is the EU's cybersecurity directive for essential and important entities across a range of sectors. Whether it applies to you depends on your sector, your size and your member state's national law, so check the legislation where you operate and take legal advice where you need it.
What does NIS2 require of suppliers?
The obligations fall on in-scope entities, not directly on their suppliers. But those entities are expected to address supply chain security, including the security practices of their direct suppliers. In practice, suppliers to in-scope entities can expect more security questions, contract clauses and evidence requests.
Does CyberRank make us NIS2 compliant?
No. CyberRank helps you assess, monitor and evidence supplier risk, which supports the supply chain part of your NIS2 programme. Compliance depends on your full set of measures and on your national law. A CyberRank rating is a posture indicator, not a certification or an audit opinion.
How is this different from a supplier questionnaire?
CyberRank is outside-in, nightly, and cascades through your supply chain. A questionnaire tells you what a supplier says about itself, once it replies. A CyberRank rating comes from public, outside-in signals, so you get a first view without waiting, and monitoring keeps it current. The two work together: CyberRank can send a questionnaire automatically when a vendor falls below your baseline. Each assessment also covers privacy policy analysis, post-quantum exposure (Beta), credential and dark web leaks, and data residency rules.
What is the Assurance Statement?
A PDF attestation, issued under IISRI®, stating that your management system has been found to be in accordance with the vendor risk management requirements of a selected standard. For ISO/IEC 27001:2022 the scope is the supply-chain controls 5.21 and 5.22. You can issue it when your vendor compliance rate is 100% and no vendor is non-compliant.
How long is the Assurance Statement valid, and how is it verified?
It is valid for one month from issue and reflects a point-in-time assessment. Anyone can check it by scanning its QR code or entering its verification code on the public verification page, which shows whether it is Valid or Expired. No login is needed.
What is a fourth party?
A fourth party is a supplier of one of your suppliers. You may have no contract with it, but a weakness there can reach you through your supplier. CyberRank shows a vendor's own suppliers, with their ratings where available, and includes them in your combined supply-chain risk score.
How is CyberRank priced?
Pricing is credit-based, with no subscription required. An assessment is 20 credits ($20) per vendor, one-off. Monitoring is 30 credits ($30) per vendor per month, with a 1-month minimum. Invoices are in USD. See the pricing page for current details.
Start with the suppliers that matter most
See how CyberRank rates your suppliers, shows their fourth parties and builds towards an Assurance Statement your customers can verify.