NIS2 supply chain certification
Customers are asking for the NIS2 Supply Chain certificate? We guide you from quick scan to audit, at level SC10, SC20, or SC30.
NIS2 Supply Chain implementation
Organizations subject to the new Cyber Security Act (Cbw) must also manage the digital risks in their supply chain. They pass this responsibility on to their suppliers through contracts, tenders, and questionnaires. With NIS2 Supply Chain compliance, formerly the NIS2 Quality Mark, you demonstrate that your security meets the requirements. Nestor Security guides you from a quick scan to the final audit.
✓“Our biggest client is suddenly asking for NIS2 guarantees from suppliers.â€
✓“The board wants to know where we stand and what needs to be done before the deadline.â€
✓“We have arranged all sorts of things, but can show very little to regulators.â€
Find out why 500+ Companies trust Nestor Security for IT security and compliance
State of affairs · July 2026
The question does not come from the regulator, but from your customer
The Cybersecurity Act has been passed and will enter into force on August 15, 2026. Organizations falling under the law are already translating their supply chain duty of care into concrete requirements in contracts and tenders. As a supplier, you notice this first.
August 15, 2026
Cybersecurity Act in effect
Both houses have passed the law. From this date, more than 8,000 Dutch organizations must demonstrably secure their supply chain.
Article 21, paragraph 2(d)
chain-of-custody obligation
NIS2 organizations must assess the digital risks of their direct suppliers and service providers and, where necessary, impose requirements on them.
1.8 million
Suppliers affected
An estimated 1.8 million European companies will deal with NIS2 as suppliers, without falling under the law themselves.
Already visible
Certificate requirements in contracts
A growing number of clients are including the NIS2 Supply Chain certificate in their procurement conditions and award criteria.
Whoever can demonstrate their security keeps the door open to existing and new clients. Whoever cannot do that drops out at the negotiating table.
Determine which level fits your role ↓The quality mark
What is the NIS2 supply chain certificate?
The NIS2 Supply Chain certificate is a quality mark with which suppliers demonstrate that their cybersecurity meets the requirements resulting from the NIS2 Directive. It was launched in October 2024 by the Foundation for Quality Innovation, developed together with about ten trade associations, and supported by MKB-Nederland and VNO-NCW.
The quality mark is intended for companies that do not fall under the Cyber Security Act themselves, but do supply to organizations that do. An independent auditor assesses your measures against a fixed standard. Following a positive evaluation, you will receive a certificate that is valid for three years and is included in a central register.
For many suppliers, especially in the SME sector, this is a feasible and affordable alternative to a complete ISO 27001 process. Moreover, it saves research work on the customer side: instead of answering every security questionnaire separately, you provide all your clients with the same independent proof.
Formerly NIS2 Quality Mark
Until early 2026, the quality mark was called the NIS2 Quality Mark. If your customer still asks about it, it refers to the same certificate.
Independently tested
The audit is carried out by an accredited certification body, not by the party that guides you. Precisely that makes the evidence credible to your clients.
ISO 27001 or NEN 7510?
Then you are exempt from the requirements that these standards already cover. As a result, the process becomes a lot shorter; sometimes your existing certificate is even sufficient.
Three levels
What level suits your organization?
The quality mark has three levels. Your role in the chain and the risk that your product or service poses to the customer determine which level is required. The client often prescribes the level in the contract or tender. If in doubt, we will determine it together during the quick scan.
For whom
SME suppliers with a limited risk profile that supply products or services to organizations subject to NIS2, without access to critical systems or sensitive data.
The audit
A test on the baseline measures: policy, access control and MFA, updates, backups, employee awareness, and incident reporting.
Good to know
For most SME suppliers, SC10 is sufficient to meet their customers' requirements.
NIS2 Level SC10
SC10, the basic level
Typical organizations
Construction and installationWholesaleTransport and logisticsFacility servicesMarketing and communicationAdministration and advice
The standard in concrete terms
What the auditor will look at later
The standard is structured around recognizable themes. The depth varies per level, but on these components you demonstrate during the audit how your organization works and what evidence belongs to it.
01
Policy and responsibilities
A concise security policy with clear roles, making it clear who is responsible for what.
02
Risk analysis
Understanding your most important systems and data, and the risks associated with them.
03
Access and accounts
Custom access permissions, multi-factor authentication, and a standardized onboarding and offboarding process.
04
Updates and vulnerabilities
Systems and software that are updated in a timely manner, with attention to known vulnerabilities.
05
Backups and recovery
Regular backups that you can actually restore when needed.
06
Awareness
Employees who recognize phishing, work securely, and know where to report an incident.
07
Incidents and notifications
A workable procedure for handling incidents and reporting them in a timely manner to customers and authorities.
08
Your own suppliers
Insight into the parties you depend on yourself, with appropriate agreements on security.
09
Physical and technical security
From server room to laptops: locations and equipment adequately protected. For SC20 and SC30, this also includes logging, monitoring, and OT.
10
Documentation and evidence
Documentation that allows you to demonstrate what you do during the audit and to clients.
Does this sound like a lot? You have probably already arranged part of this. The quick scan shows what is still missing for the level your customer requires.
See how we tackle this together ↓The approach
How Nestor Security gets you to the certificate
The standard describes what you must comply with, not how you organize that alongside your regular work. That is precisely where the difference lies.
Figure it out yourself
A lot of research, uncertain result
✕Translating the standard itself into policy, measures, and evidence
✕Chance of a wrongly chosen level or a failed audit
✕Continuing to answer every customer's security questionnaire separately
Met Nestor Security
Guided, practical, and right the first time
✓A quick scan that clearly outlines level, gaps, and planning all at once
✓We help draft policies and set up the measures with you
✓You will enter the audit well-prepared, with an accurate evidence file.
The process
In six steps to the NIS2 Supply Chain certificate
Depending on the level and your starting situation, a program typically takes two to six months. We guide every step, from the initial scan up to and including the audit day.
Typical blockade
Unclear what level your customer expects and where your organization currently stands.
How we help
We assess your role in the chain and your current measures against the standard.
Result
A chosen level, a gap overview, and a realistic schedule.
Step 1
Quick scan and level selection
What happens:
Intake regarding your services, clients, and contractual requirements
Testing of existing measures against SC10, SC20 or SC30
Concrete overview of what is present and what is still missing
Advice on level, duration, and costs
Why Nestor Security
A partner who looks beyond the audit day
The certificate is valid for three years, but hopefully your customer relationships last longer. That is why suppliers choose a partner who will still be there even after the presentation.
01
At home in both standard and law
We work with the quality mark scheme on a daily basis and closely follow the Cybersecurity Act. This ensures you do not miss any requirements and do not do anything twice.
02
Measures tailored to SMEs
No forty-page policy, but agreements and technology that fit the size of your company and withstand the audit.
03
Certification and security under one roof
From this quality mark to ISO 27001, security scans, and the secondment of specialists: you do not need to look for a new party for every step.
04
Proven at 500+ organizations
Short communication lines, a dedicated contact person, and trajectories that pass the audit on time, from small SMEs to large organizations.
Does this look familiar?
✓A customer makes the certificate a requirement in a contract or tender.
✓Clients' security questionnaires are piling up.
✓You do not know whether SC10, SC20, or SC30 applies to you.
✓Everything has been arranged, but little is in writing.
✓Nobody has time to do this on a structural basis.
Free quick scan planFree and without obligation. You will know where you stand within a few days.
The other side of the chain
Subject to NIS2 yourself and need control over your suppliers?
This quality mark therefore works both ways. By including the certificate in your purchasing terms and conditions, you fulfill the duty of care for your supply chain without having to screen each supplier individually. We help you set up that side of things practically.
Step A
Suppliers in focus
We inventory and classify your suppliers by risk, making it clear who needs which level.
Step B
Requirements in contracts
We help incorporate certification requirements and security agreements into purchasing terms, contracts, and SLAs.
Step C
Assessment and follow-up
We are setting up a procedure to periodically check and record certificates and agreements.
This is how you comply with Article 21, paragraph 2d without unnecessarily burdening your supply chain, while keeping a feasible perspective for your suppliers.
Discuss your chain approach with a specialist ↓More than a certificate
Your quality mark is the foundation for the next step
The measures for the quality mark overlap heavily with broader standards. What you are building now, you will reuse as soon as customers or legislation demand more.
Your foundation
NIS2 supply chain certificate
An independently tested package of measures, featuring policy, evidence, and a reporting process. The core upon which every subsequent standard builds.
Logical next step
+ ISO 27001
Do larger customers ask for the international information security standard? Your certification measures already cover a significant part of it.
Do you supply to the healthcare sector?
+ NEN 7510
For suppliers in the healthcare supply chain, we combine the quality mark and the healthcare-specific standard into a single process.
Are you subject to the law yourself?
Cybersecurity Act
Is your organization growing into the scope of the law, or does it turn out that you are subject to the NIS2 directive after all? Then we will expand your foundation to achieve full compliance, including reporting obligations and registration.
Success stories
Don't just take it from us
You are in good company with Nestor.
Learn more about NIS2 Supply Chain?
Meet Nestor Security
Your questions answered
FAQs
What is the NIS2 supply chain certificate?
The NIS2 Supply Chain certificate is a quality mark with which suppliers demonstrate that their cybersecurity complies with the requirements stemming from the NIS2 Directive. It was developed by the Quality Innovation Foundation (Stichting Kwaliteitsinnovatie) together with about ten industry associations and is audited by an independent certifying body. Until early 2026, the quality mark was called the NIS2 Quality Mark; it refers to the same certificate.
What is the difference between SC10, SC20, and SC30?
SC10 is the baseline level, intended for suppliers with a limited risk profile. SC20 applies to companies with an increased risk due to their role or access, such as ICT service providers and parties with access to sensitive data or OT environments. SC30 is the highest level, for critical links in the chain. The greater the impact of your service on the customer, the higher the level. During the quick scan, we determine together which level suits your situation and customer requirements.
We already have ISO 27001 or NEN 7510. What does that mean?
Then you are exempt from the quality mark requirements that your existing standard already covers, and the process will be considerably shorter. In some cases, your customer already accepts your current certificate as sufficient proof. We will test that first, so you do not do double work.
A client is asking for ISO 27001. Is NIS2 Supply Chain compliance also an option?
Often yes. For many suppliers, ISO 27001 is heavier and more expensive than their role in the supply chain justifies. The NIS2 Supply Chain certificate was specifically developed as a feasible alternative for subcontractors and is being accepted by an increasing number of clients. Do have that conversation with your client, however. We provide the substantiation and help think about what is wise in your situation.
Our organization falls under the Cybersecurity Act. Is NIS2 Supply Chain sufficient?
No. If your organization itself falls under the law, the duty of care, reporting obligation, and registration obligation apply directly, and more is required than the quality mark alone. In that case, SC30 is the minimum certification level in the chain. We also guide complete NIS2 trajectories, from quick scan to demonstrable compliance.