EUAlternatives
    Compliance

    NIS2 Compliance: What Every European SaaS Buyer Must Know

    EU Alternatives Team19 March 202611 min read

    The Network and Information Security Directive 2 (NIS2) is the most significant upgrade to EU cybersecurity law in a decade. Adopted in January 2023 and transposed into national law across member states throughout 2024 and 2025, enforcement is now actively ramping up. For SaaS buyers, this is not just an IT concern: it's a procurement, legal, and operational priority.

    This guide explains what NIS2 means for organisations that rely on SaaS vendors, and what practical steps you should take right now.

    What Is NIS2, and Why Does It Matter?

    NIS2 replaces the original NIS Directive from 2016, which was widely criticised for inconsistent implementation and a narrow scope. The new directive addresses those shortcomings with three major changes:

    1. Dramatically expanded scope: NIS2 covers far more sectors and organisations than its predecessor
    2. Stricter obligations: Mandatory incident reporting, supply chain security, and risk management measures
    3. Real enforcement teeth: Fines of up to 10 million euros or 2% of global turnover, plus personal liability for management

    Who Is Affected?

    NIS2 applies to two categories of organisations:

    Essential Entities

    These face the strictest oversight and include:

    • Energy (electricity, oil, gas, hydrogen)
    • Transport (air, rail, water, road)
    • Banking and financial market infrastructure
    • Healthcare
    • Drinking water and wastewater
    • Digital infrastructure (DNS, TLD registries, cloud providers, data centres, CDNs)
    • ICT service management (managed service providers, managed security service providers)
    • Public administration
    • Space

    Important Entities

    Subject to lighter supervision but still bound by NIS2 obligations:

    • Postal and courier services
    • Waste management
    • Chemical manufacturing and distribution
    • Food production and distribution
    • Manufacturing (medical devices, electronics, machinery, motor vehicles)
    • Digital providers (online marketplaces, search engines, social networks)
    • Research organisations

    The key point for SaaS buyers: even if your organisation is not directly classified as essential or important, your vendors might be. And if you are in scope, your choice of vendors becomes a compliance factor.

    The Supply Chain Dimension

    This is where NIS2 gets particularly relevant for SaaS procurement. Article 21 explicitly requires organisations to address cybersecurity risks in their supply chains, including:

    • Assessing the security practices of direct suppliers and service providers
    • Evaluating the overall quality of products and cybersecurity practices of suppliers
    • Considering the results of coordinated security risk assessments of critical supply chains

    In plain terms: if you are a NIS2-regulated entity, you need to be able to demonstrate that your SaaS vendors meet appropriate security standards. "We trust them" is no longer sufficient.

    What to Ask Your SaaS Vendors

    When evaluating existing or prospective SaaS providers under NIS2, here are the essential questions:

    Security Governance

    • Do you have a documented information security management system (ISMS)?
    • Are you certified under ISO 27001, SOC 2, or the upcoming EUCS (EU Cloud Certification Scheme)?
    • How do you handle vulnerability management and patching cycles?

    Incident Response

    • What is your incident detection and response process?
    • Can you commit to notifying us of significant incidents within 24 hours (aligning with NIS2's early warning requirement)?
    • Do you conduct regular incident response exercises?

    Data Protection and Residency

    • Where is our data stored and processed?
    • Do you use sub-processors outside the EU? If so, under what legal framework?
    • Can you provide EU-only data residency if required?

    Supply Chain Transparency

    • Who are your critical infrastructure providers (cloud, CDN, DNS)?
    • Are those providers also NIS2-compliant or working towards compliance?
    • How do you assess and monitor the security of your own supply chain?

    Business Continuity

    • What are your disaster recovery and business continuity capabilities?
    • What is your guaranteed uptime, and how is it measured?
    • Do you maintain geographically redundant infrastructure within the EU?

    NIS2 and the Case for EU-Based Vendors

    While NIS2 does not mandate using EU-based vendors, the directive's requirements naturally favour providers with:

    • EU data residency: Simplifies compliance with data localisation expectations
    • Transparent supply chains: EU-based providers typically have shorter, more auditable supply chains
    • Alignment with EU certification schemes: Providers already working towards EUCS certification
    • No extraterritorial legal conflicts: No exposure to the US CLOUD Act or similar foreign data access laws

    For organisations in regulated sectors, choosing EU-sovereign SaaS providers can significantly reduce the compliance burden. It removes an entire layer of legal and technical risk from the supply chain assessment.

    Practical Steps for SaaS Buyers

    Immediate Actions

    1. Determine your NIS2 status: Are you an essential entity, important entity, or neither? Check your national transposition law for precise thresholds
    2. Inventory your SaaS vendors: Map out which vendors handle critical functions and what data they process
    3. Review existing contracts: Check for incident notification clauses, security commitments, and audit rights

    Medium-Term Actions

    1. Send security questionnaires: Use the questions above as a starting point for vendor assessments
    2. Request certifications: Ask vendors for ISO 27001 certificates, SOC 2 reports, or evidence of EUCS readiness
    3. Update procurement policies: Include NIS2-relevant security criteria in your vendor selection process

    Ongoing

    1. Monitor vendor compliance: Set up periodic reviews (at least annually) of vendor security posture
    2. Track national enforcement: NIS2 transposition varies by member state, so stay current with your local authority's guidance
    3. Document everything: NIS2 places emphasis on demonstrable compliance, so maintain records of your assessments and decisions

    The Management Liability Factor

    One aspect of NIS2 that should focus minds in the C-suite: the directive introduces personal accountability for management bodies. Senior leadership must approve cybersecurity risk management measures and can be held liable for non-compliance.

    This means cybersecurity, including SaaS vendor risk, is no longer something that can be fully delegated to IT. Board-level awareness and sign-off on vendor security assessments is now a regulatory expectation.

    Looking Ahead

    NIS2 enforcement will intensify throughout 2026 as national authorities build up their supervisory capacity. Early movers have a clear advantage: organisations that start their vendor assessments and supply chain reviews now will be better positioned than those scrambling to comply under regulatory pressure.

    For SaaS buyers, the message is straightforward: know your vendors, document your due diligence, and make security a first-class criterion in procurement. The directive isn't about perfection. It's about demonstrating that you take supply chain cybersecurity seriously, and can prove it.