Introduction
The NIS2 directive is becoming increasingly important, especially in light of the growing threat of supply chain attacks. Such attacks exploit vulnerabilities within an organization's supply chain - including third-party vendors or software updates - to compromise the ultimate target. Often the weakest link is targeted, meaning that a single compromised element can put multiple organizations at risk simultaneously. In response to this threat, the EU has introduced the NIS2 Directive, which requires coordinated risk assessments and increased cybersecurity compliance in selected industries. Prominent examples such as the SolarWinds Orion platform attack and the Log4j vulnerability highlight the vulnerability of software supply chains.
What are supply chain attacks?
Supply chain attacks can be divided into different categories:
-
Software Supply Chain Attacks
-
Hardware supply chain attacks
-
Attacks on service providers
Each of these categories requires specific risk mitigation measures to ensure robust supply chain security and to comply with the NIS2 directive.
Software supply chain
Software supply chain attacks involve the injection of malicious code into software products or updates. This can happen via compromised development environments - as in the SolarWinds incident - or via malicious open source components - as in the case of Log4j. The risk increases with the number of dependencies and third-party libraries. Once distributed, affected software puts all users at risk. To comply with the NIS2 directive, organizations must gain full transparency of their software supply chains and establish secure development and update processes.
Hardware supply chain
In hardware supply chain attacks, physical components are manipulated during production or distribution. Attackers could, for example, introduce malicious firmware or hardware modules - such as network components - in order to tap into data. Although such attacks are less common than software-based threats, they are particularly difficult to detect and extremely dangerous. As part of NIS2 compliance, companies must integrate security checks and control mechanisms into their hardware procurement processes.
Service providers
IT service providers and managed service providers (MSPs) are particularly targeted by attackers due to their extensive access rights. The SolarWinds case showed how a single compromised service provider can gain access to numerous customer networks. To be NIS2 compliant, companies need to carefully vet their service providers and enforce security standards such as multi-factor authentication, monitoring and contractual cybersecurity compliance.
Challenges in detecting supply chain threats
All types of supply chain attacks are difficult to detect - especially in large, distributed IT infrastructures. Nevertheless, comprehensive risk assessments are essential for NIS2 compliance. software-based attacks are more common because they are easier to automate. Nevertheless, hardware and service-based threats must not be underestimated - such as Operation Grim Beeper, which caused thousands of pagers to fail in Lebanon in 2024.
NIS2 compliance and supply chain security
The NIS2 directive emphasizes the need for robust cybersecurity compliance in critical sectors. A key element is coordinated risk assessment to identify vulnerabilities and protect critical infrastructure. Companies must analyze both technical and non-technical aspects of their supply chains - from software dependencies and third-party providers to geopolitical risks. These assessments are carried out by the so-called Cooperation Group, which is made up of representatives of the EU Member States, the EU Commission and the EU Agency for Cybersecurity (ENISA).
To meet the requirements of the NIS2 Directive, companies should:
-
Maintain an up-to-date asset database and software bill of materials (SBOM)
-
Continuously monitor third-party risks
-
Establish contingency plans for incidents in the supply chain
-
Integrate security requirements into the procurement process
With these measures, organizations strengthen their supply chain security while implementing EU-wide cybersecurity compliance requirements.
Conclusion
Supply chain attacks pose a growing threat to cybersecurity and endanger entire networks through shared components. The NIS2 Directive creates the regulatory framework to make supply chains more resilient through coordinated risk assessments and comprehensive security measures. For companies that want to protect critical infrastructures and sensitive data, implementing the NIS2 requirements is essential. Those who bring transparency to their supply chain, systematically integrate third-party providers and establish cybersecurity at all levels will ensure long-term digital resilience in the EU.
