NIS2 Quality Mark

For companies in the supply chain, it is important to demonstrate to your customers that your cybersecurity is in order. You need to provide proof of this. You can do so through NIS2 QM certification—a practical standard for SMEs. This shows your larger clients, who fall directly under NIS2, that you are a secure supplier.

The NIS2 Quality Mark has been specifically developed for SMEs and is recommended by leading cybersecurity firms and industry associations.

The importance of the NIS2 Quality Mark

Companies that obtain the NIS2 Quality Mark demonstrate that they meet the stricter requirements of the NIS2 directive. Proven cybersecurity through this certification also makes it easier to obtain cyber insurance. Banks also take this into account when granting loans to SMEs. Furthermore, cybersecurity has now become a standard part of the risk assessment when selling your business.

The NIS2 Quality Mark is your “license to operate”.

Which companies are suppliers under NIS2?

It is the essential and important NIS2 entities themselves who determine which direct suppliers pose a risk. With the NIS2 Quality Mark, they can easily comply with this obligation. If you want to learn more about NIS2 or find out whether you will be affected by it, attend a webinar at Samen Digitaal Veilig.
Below is an overview of examples of suppliers who may fall under NIS2:

What certificates are required?

If your company supplies large organisations that, in turn, supply NIS2 entities, or if you supply directly to NIS2 entities, then NIS2-QM10 is the certification standard you can use to demonstrate compliance with the required security standards. This is the standard norm for most companies active in the supply chain.

NIS2 is all about managing risks

When a supplier is insufficiently secured, this can pose a risk to the NIS2 companies they serve directly or indirectly. This may lead to vulnerabilities in IT, digital communication, physical infrastructure, electronic data interchange (EDI), supply and ordering systems, and even in products containing operational technology (OT) software. OT software controls machines, whether or not they are connected to the internet. Since NIS2 adopts an ‘all hazards’ approach, various types of risks are considered, not just those related to IT.

The key rule of thumb is: the greater the impact of your products or services on your customer, the higher the risk you pose, and consequently, the higher the standard you must meet. For most SMEs in the supply chain, the NIS2-QM10 certificate is sufficient. So, do you supply companies that themselves supply NIS2 entities, or do you supply directly to an NIS2 organisation? And are you not an IT or OT company? Then NIS2-QM10 is the minimum certification standard to demonstrate that your company has implemented adequate security measures.

If you believe your company may pose a higher risk—for example, because you have access to highly sensitive data, your product is an essential component for your customer, or your product is difficult to replace—discuss a possible higher certification standard with your customer. If you are unsure whether you need a higher-level certificate, please contact the support desk for advice.