[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-d":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-d","Article 21(2)(d)","Supply chain security (Article 21(2)(d))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (d) requires measures for supply chain security, including security aspects of relationships between the entity and its direct suppliers or service providers. Article 21(3) adds that entities should consider supplier specific vulnerabilities, product quality and suppliers' secure development practices.\n\n**In practice.** The entity inventories its suppliers, ranks them by criticality, assesses their security, includes security and incident notification clauses in contracts and monitors them over time. Results of coordinated EU supply chain risk assessments are taken into account where relevant. Evidence includes the supplier register, assessments, contract terms and monitoring records.\n\n**Common gaps.** Many entities rely only on questionnaires and do not cover managed service providers or software suppliers deeply enough. Contracts with existing suppliers often predate NIS2 and lack the needed clauses.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},58,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto","North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto","2026-11-13T22:21:35.043+00:00",{"slug":24,"title":25,"published_at":26},"hardware-implants-in-reseller-wallets-highlight-supply-chain-risks","Hardware Implants in Reseller Wallets Highlight Supply Chain Risks","2026-11-13T20:20:40.226+00:00",{"slug":28,"title":29,"published_at":30},"third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations","Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations","2026-11-13T20:20:22.449+00:00",{"slug":32,"title":33,"published_at":34},"fake-interview-assignments-weaponize-npm-packages-to-compromise-developer-machines","Fake Interview Assignments Weaponize npm Packages to Compromise Developer Machines","2026-11-13T18:21:36.396+00:00",{"slug":36,"title":37,"published_at":38},"compromised-update-server-grounds-german-military-drones","Compromised Update Server Grounds German Military Drones","2026-11-13T18:20:23.075+00:00",{"slug":40,"title":41,"published_at":42},"third-party-cloud-provider-breach-exposes-tsmc-employee-data","Third-Party Cloud Provider Breach Exposes TSMC Employee Data","2026-11-13T16:22:01.669+00:00",{"slug":44,"title":45,"published_at":46},"baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks","Baker Tilly Breach and AI Privilege Escalation Highlight Third-Party and Access Control Risks","2026-11-13T16:21:20.633+00:00",{"slug":48,"title":49,"published_at":50},"leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes","Leaked Secrets and a Backdoored AI Tool Give Attackers Cloud Access in Minutes","2026-11-13T16:21:03.622+00:00",{"slug":52,"title":53,"published_at":54},"north-korean-facestealer-social-engineering-and-open-source-compromise-fuel-400m-crypto-theft","North Korean FaceStealer: Social Engineering and Open-Source Compromise Fuel $400M Crypto Theft","2026-11-13T15:21:17.928+00:00",{"slug":56,"title":57,"published_at":58},"malware-hidden-in-drone-software-update-grounds-german-military-fleet","Malware Hidden in Drone Software Update Grounds German Military Fleet","2026-11-13T14:20:41.076+00:00",{"slug":60,"title":61,"published_at":62},"compromised-iam-credentials-and-third-party-vendor-breaches-expose-customer-data-across-multiple-org","Compromised IAM Credentials and Third-Party Vendor Breaches Expose Customer Data Across Multiple Organizations","2026-11-13T11:21:34.52+00:00",{"slug":64,"title":65,"published_at":66},"third-party-cloud-provider-exposes-46000-tsmc-employee-records","Third-Party Cloud Provider Exposes 46,000 TSMC Employee Records","2026-11-13T06:20:42.501+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",23,{"slug":74,"name":75,"problem":76,"stories":77},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",20,{"slug":79,"name":80,"problem":81,"stories":82},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",13,{"slug":84,"name":85,"problem":86,"stories":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",12,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",10,{"slug":94,"name":95,"problem":96,"stories":97},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",9,[99,105,111,115,120,125,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"iso-27001","a-5-19","Annex A 5.19","ISO\u002FIEC 27001:2022 Annex A 5.19: Information security in supplier relationships",17,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","sa-12","SA-12","Supply Chain Protection",16,{"family":106,"item":112,"code":113,"title":114,"together":110},"sa-9","SA-9","External System Services",{"family":116,"item":117,"code":118,"title":119,"together":87},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":116,"item":121,"code":122,"title":123,"together":124},"16","Control 16","Application Software Security",11,{"family":126,"item":127,"code":128,"title":129,"together":130},"mitre-attack","t1195-001","T1195.001","Compromise Software Dependencies and Development Tools",8,{"family":126,"item":132,"code":133,"title":134,"together":135},"t1195","T1195","Supply Chain Compromise",7,{"family":116,"item":137,"code":138,"title":139,"together":140},"1","Control 1","Inventory and Control of Enterprise Assets",6]