What can a NIS2-regulated partner require from its supplier?
Which suppliers are primarily affected, what is mandatory, and what can be added by contract.
4 November 2026 · P1R4T3 Research
In brief
Under Hungarian rules, an organization subject to NIS2 must ensure that partners working on its systems meet risk-proportionate security requirements as a contractual obligation. Not every supplier is therefore in the same position, and requirements may differ between partners.
Who is primarily affected?
The Act refers to contributors: those involved in creating, operating, auditing, maintaining or repairing an electronic information system, providing cloud services, handling cybersecurity incidents, or processing data related to the system (Act LXIX of 2024, section 6(5)(d)).
In practice this may include an IT provider, software supplier, cloud provider or maintenance contractor with access to the system. For other suppliers, the question depends mainly on the partner's contract and its own risk assessment.
What must the regulated organization do?
- Include risk-proportionate requirements in the contract.
- Set out the necessary protective measures and the division of responsibility.
- Check the provider of an external system using external and internal means.
- Ensure that requirements also reach subcontractors' contracts.
- Assess supply chain risks at a defined frequency; this obligation depends on the security class.
This is why you may receive a questionnaire, a contract amendment or a request for verification.
What else can it require?
Beyond the mandatory minimum, the contract may also include:
- a right of audit by the customer or its appointee,
- a certificate or report such as ISO/IEC 27001, ISAE 3402 or SOC 2,
- regular vulnerability assessment and independent penetration testing,
- stricter service levels (SLA),
- source code escrow and a software bill of materials (SBOM) for custom software.
What to do when you receive such a request
- Read exactly what is being asked. A questionnaire, a certificate and an independent test call for different actions.
- Ask about the deadline and evidence. Will the partner accept a remediation plan for a missing measure?
- Answer only truthfully. Mark unmet points and add the planned remediation date.
- Review your own subcontractors. The requirement may pass further down the chain.
How we can help
The NIS2 quick assessment shows where you stand and provides a remediation plan. We also provide independent penetration testing. We cannot replace a certificate or an official audit: if your partner requires one, the assessment only helps you prepare.
Sources
Act LXIX of 2024, section 6(5)(d); MK Decree 7/2024 (VI. 24.), Annex 2, points 15.5, 16.7, 16.49, 19.7 and 19.16, as set out in legal opinion 2026/18 of the MKIK NIS2 programme (20 February 2026). This article is for information only and is not legal advice. Check the text in force for individual cases.