Supplier onboarding under NIS2: what does Section 30 BSIG require for the supply chain?

The BSI Act as amended by the Act implementing the NIS2 Directive (Federal Law Gazette BGBl. 2025 I No. 301) distinguishes between essential and important entities (Section 28 BSIG). What counts is the type of entity listed in Annexes 1 and 2 – for example energy, transport, finance, postal and courier services or manufacturing – and its size.

An entity listed in Annex 1 is essential from 250 employees, or from an annual turnover of more than €50 million combined with a balance sheet total of more than €43 million. An entity listed in Annex 1 or 2 is important from 50 employees, or from a turnover and balance sheet total of more than €10 million each. Some entities, such as operators of critical facilities, are covered regardless of size.

Suppliers do not have to fall under the Act themselves to feel its effects: their customers must demonstrate the security of the supply relationship and therefore pass the requirements on to them.

Section 30(2) lists ten measures that risk management must include as a minimum. Number 4 names supply chain security, including the security-related aspects of the relationships with direct suppliers or service providers. Number 5 adds security in acquisition, development and maintenance, including vulnerability handling and disclosure.

Directive (EU) 2022/2555 is more specific here: under Article 21(3), entities take into account the vulnerabilities specific to each direct supplier as well as the overall quality of products and cybersecurity practices of their suppliers. This paragraph is not reproduced word for word in the German Act; the explanatory memorandum (Bundestag printed paper 21/1501) refers to it in its notes on Section 30.

The Act does not prescribe a fixed questionnaire. Four steps have proven useful: classify suppliers by criticality (which data, systems and processes do they touch?), set minimum requirements per class, check compliance against evidence and file the result so that it can be presented in an audit.

Typical requirements cover access protection such as multi-factor authentication, encryption, vulnerability and patch management, emergency preparedness, reporting channels for security incidents and certifications such as ISO/IEC 27001. If the supplier processes personal data on your behalf, the agreement under Art. 28 GDPR is added.

The review is not a one-off: certificates expire, subcontractors change, requirements evolve. Recurring checks are therefore part of risk management.

Under Section 33 BSIG, affected entities must register with the BSI no later than three months after they first qualify as an entity. According to the BSI, this deadline has expired for entities that were already covered when the Act entered into force; they must register without delay.

Management must implement the risk management measures and monitor their implementation (Section 38(1) BSIG) and take part in training regularly (Section 38(3) BSIG).

Under Section 65 BSIG, breaches of Section 30 can be fined up to €10 million for essential entities and up to €7 million for important entities. For a worldwide annual turnover of more than €500 million, the ceiling is 2% or 1.4% of that turnover.

Vendo4u does not map the requirements as one questionnaire per customer but as a shared catalog: suppliers record their information on information security, data protection and business continuity once and back it up with documents attached to each criterion. Buyers filter by their minimum requirements, compare suppliers and export the profile including evidence for their own documentation.

The duty to assess remains with the entity. Vendo4u provides a uniform, traceable basis for it.