NIS2 Supply Chain Security
for Web Agencies

does-this-apply-to-us

NIS2 classifies covered organisations as "essential" or "important" based on sector and size. Many small agencies fall outside direct scope — a 5-person studio building marketing sites is usually not itself a covered entity.

But being out of scope does not mean the supply chain rules do not touch you. Three practical reasons why in-scope clients push NIS2 requirements down to their agencies:

1. Procurement questionnaires. Any agency serving mid-size or enterprise clients, public sector bodies, or companies in energy, health, finance, transport or digital infrastructure is already seeing security questionnaires that reference NIS2. "Describe your vendor management process" is now a standard field.

2. Contract clauses. In-scope clients must manage the security of their own suppliers — and their web agency is a supplier. Expect contractual security requirements, audit rights and incident notification duties to appear in new and renewed agreements.

3. Chain liability in incidents. When a breach at an agency exposes a covered client, the client still carries its own NIS2 duties — 24-hour early warning, 72-hour notification. Agencies that cannot support that timeline lose those clients.

your-actual-supply-chain

Before you can manage vendor risk, you need to know what your supply chain actually is. Most agencies have never written it down. Map yours in one afternoon:

vendor-assessment

You do not need an enterprise GRC platform. A spreadsheet with one row per vendor and five columns covers Article 21 for a small agency:

1. What data and access does this vendor have? Client personal data? Admin credentials? Production servers? Classify: critical, important, minor.

2. What is their security posture? Do they publish a trust page, ISO 27001 or SOC 2 certification, a DPA, a breach history? For major providers (Cloudflare, AWS, Google) this is a ten-minute check. For a $29/year plugin vendor, the honest answer may be "unknown" — which is itself a risk rating.

3. What does the contract say? Is there a DPA (GDPR Article 28), security obligations, breach notification terms, and a right to terminate? For critical vendors, no contract means no managed relationship.

4. What happens if they fail? Do you have an exit path — exports, alternative providers, DNS you control? A vendor you cannot leave is a vendor you cannot manage.

5. When was this last checked? Set an annual review date. A risk register that is never revisited is theatre.

contract-clauses

The assessment tells you where you stand; contracts are what make the risk manageable. Four clauses to standardise in your own client and vendor agreements:

With your vendors (when you have negotiating power): breach notification within 24-48 hours, documented security measures, sub-processor transparency, and data deletion on exit. With hyperscalers you take their standard terms — which is fine, and itself worth documenting as an accepted risk.

With your clients: define exactly which systems you are responsible for securing (and which remain the client's), a security-contact and incident cooperation clause so you can support their 24/72-hour NIS2 timelines, a change-management clause for credential handover, and a limitation of liability that is proportionate to a small agency — not unlimited.

If you serve in-scope clients, align your incident notification commitment with their regulatory clock. "We will tell you within 24 hours of confirming a breach" is a clause that wins enterprise work.

reducing-the-attack-surface

The cheapest supply chain risk treatment is having less supply chain. Four moves that cut real risk for a typical agency in under a week:

1. Kill unused access. Audit admin accounts across hosting, DNS, client sites and code repositories. Remove every account belonging to people who no longer work with you. This is the single highest-yield hour in agency security.

2. Standardise your stack. Every unique plugin, theme and service multiplies your assessment burden. A short allow-list — "these are the plugins and providers we use" — makes vendor management finite and client security reviews faster.

3. Watch for abandoned software. Set a rule: any plugin or dependency without a release in 12+ months gets replaced or isolated. Abandoned components are the classic small-site breach vector.

4. Separate the keys. Use a password manager with per-client vaults and MFA everywhere it is supported. One shared spreadsheet of client credentials is a supply chain incident waiting for a trigger.

what-regulators-expect

If a supervisory authority ever asks — or an in-scope client audits you — the expectation is proportionate, documented practice, not perfection. Your evidence pack should contain:

• A current vendor register with criticality ratings and review dates

• Signed DPAs with every vendor that processes personal data

• Standard contract clauses (yours and accepted third-party terms)

• An access-control policy: who has admin access, how it is granted and revoked

• An incident response plan that includes vendor-originated incidents and supports client notification timelines

That is six documents, most of which a small agency should have anyway for GDPR. NIS2 supply chain compliance, done pragmatically, is largely the paperwork you already owed under the data protection rules — extended to security, and actually maintained.

Going Deeper

Our NIS2 e-book includes vendor assessment templates, contract clauses, an incident reporting playbook and a 14-day action plan — everything a small agency needs.

Frequently Asked Questions

Related Guides

NIS2 COMPLIANCE

Is Your Small Web Agency NIS2-Ready?

NIS2 INCIDENTS

NIS2 Incident Report Checklist & Template

GDPR COMPLIANCE

GDPR Data Processing Agreement for Web Agencies