{"id":27859,"date":"2024-10-30T22:13:22","date_gmt":"2024-10-30T21:13:22","guid":{"rendered":"https:\/\/www.digitrust.nl\/?p=27859"},"modified":"2026-03-16T11:56:34","modified_gmt":"2026-03-16T10:56:34","slug":"are-you-a-supplier-to-a-nis2-organisation","status":"publish","type":"post","link":"https:\/\/www.digitrust.nl\/en\/nieuws\/bent-u-leverancier-aan-een-nis2-organisatie\/","title":{"rendered":"NIS2 guideline: Are you a supplier to an NIS2 organisation?"},"content":{"rendered":"

NIS2 Directive - Quality Mark<\/h1>\n

NIS2 legislation describes that essential and important companies, also known as NIS2 companies, are responsible for the cyber security of their supply chain. This means that they have to start requiring their direct suppliers, mostly SMEs, to be able to demonstrate that they work securely digitally. NIS2-compliant organisations demonstrate this with an NIS2 Quality Mark certificate.<\/p>\n

DigiTrust <\/strong>can provide you and your suppliers in accordance with the NIS2 Quality Mark<\/a> auditing and certification.<\/p>\n

What type of organisation are you?<\/h2>\n

Many SME organisations provide services to so-called NIS2 companies. To determine whether or not your organisation itself is an NIS2 organisation, the NCSC has a poster<\/a> made and online NIS2 self-assessment<\/a> test. Organisations characterised as an NIS2 organisation must of course comply with the NIS2 guideline and are also required to register with the NCSC. <link<\/a>><\/p>\n

note: Each country has made its own translation of the European NIS2 legislation. In the Netherlands, this will be the Cyber Beveiligings Wet, abbreviated CBW. This law is expected to be published June\/July 2025.<\/em><\/p>\n

Within the NIS2 legislation, a distinction is made between essential and important companies, these are also called NIS2 companies. These companies have to comply with the NIS2 legislation themselves, but also their supply chain. So the NIS2 Quality Mark helps with this.<\/p>\n

NIS2 guideline: different levels<\/h2>\n

Within NIS2 Quality Mark, there are 3 levels, tailored to the risk of the service provided.<\/p>\n

    \n
  1. NIS2-QM10 (Basic)<\/li>\n
  2. NIS2-QM20 (Substantial)<\/li>\n
  3. NIS2-QM30 (High)<\/li>\n<\/ol>\n

    \"NIS2<\/p>\n

    Suppliers - NIS2 guideline<\/h2>\n

    NIS2 organisations must start requiring their suppliers, mostly SME organisations, to be able to demonstrate compliance with NIS2 legislation. Having an ISO27001 certificate is not enough for this purpose. For this, the NIS2 Quality Mark certificate provides additional evidence with which they demonstrate compliance with the NIS2 guideline.<\/p>\n

    Quality Mark 10 (QM10)<\/h2>\n

    If your organisation is not subject to registration, but you provide services to an NIS2 organisation, your organisation must also comply with NIS2. For most SME organisations, Quality Mark level 10 (QM10) will be sufficient, to demonstrate that you have the basics in place.<\/p>\n

    Quality Mark 20 (QM20)<\/h2>\n

    However, if your organisation provides ICT or OT services, your client may demand QM20 or even QM30. Of course, this strongly depends on the risk the client has regarding your delivered service and the impact on the GIS.<\/p>\n