Tidal Control incident
NIS2 for suppliers to NIS2-obligated organizations: what do you need to arrange now?
Resolved on February 21, 2026.
NIS2-obligated organizations must contractually manage their supplier risk under Article 21, so suppliers who are too small to fall under NIS2 themselves still receive the requirements through questionnaires, contract clauses, and requests for evidence. The four measures clients ask about most are multi-factor authentication, timely updates, tested backups, and least-privilege access rights. Demonstrability is what counts, and three common routes exist: NIS2 Supply Chain (SC10, SC20, or SC30), CyberFundamentals, or ISO 27001, with the right choice depending on your role and the market your clients operate in.
Update timeline
- resolved Feb 21, 2026, 12:00 AM UTC
NIS2-obligated organizations must contractually manage their supplier risk under Article 21, so suppliers who are too small to fall under NIS2 themselves still receive the requirements through questionnaires, contract clauses, and requests for evidence. The four measures clients ask about most are multi-factor authentication, timely updates, tested backups, and least-privilege access rights. Demonstrability is what counts, and three common routes exist: NIS2 Supply Chain (SC10, SC20, or SC30), CyberFundamentals, or ISO 27001, with the right choice depending on your role and the market your clients operate in.
Your product runs on more than Tidal Control
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services