NIS2 for SaaS Vendors: 5 Requirements Your EU Clients Expect

NIS2 in 60 seconds

The EU's NIS2 Directive (Directive (EU) 2022/2555) is the most consequential cybersecurity regulation to hit Europe since GDPR. It replaces the original 2016 NIS Directive and dramatically expands both the scope and the consequences.

Member states had until 17 October 2024 to transpose NIS2 into national law. Most have. The directive is now being enforced across the EU through national supervisory authorities — ANSSI in France, BSI in Germany, CCB in Belgium, ACN in Italy, and so on.

Why you should care as a SaaS vendor: Even if you're not directly in scope, your EU enterprise customers are. And they will push their NIS2 obligations onto you through procurement, contracts, and security questionnaires. If you can't answer yes to the questions they're about to ask, you'll lose the deal.

Who NIS2 applies to (directly)

NIS2 applies to two tiers of organizations:

"Essential entities" — strictest obligations

Large organizations (250+ employees OR €50M+ revenue) operating in:

Energy (electricity, oil, gas, district heating)
Transport (air, rail, water, road)
Banking and financial market infrastructure
Health (hospitals, EU medicines, in vitro diagnostic medical devices)
Drinking and waste water
Digital infrastructure (DNS providers, TLD registries, cloud computing services, data center services, content delivery networks, trust service providers, public electronic communications networks/services)
ICT service management (managed service providers, managed security service providers)
Public administration
Space

"Important entities" — same security obligations, lighter supervision

Medium organizations (50-249 employees OR €10-50M revenue) in essential sectors, plus large/medium organizations in:

Postal and courier services
Waste management
Manufacture/distribution of chemicals
Food production, processing, distribution
Manufacturing (medical devices, electronics, machinery, vehicles, transport equipment)
Digital providers (online marketplaces, search engines, social networks)
Research

Note for vCISOs and MSSPs: "Managed security service providers" are explicitly listed as essential entities. If you're an MSSP serving EU clients, you may be directly in scope yourself, regardless of your customers.

What NIS2 requires

Article 21 lists the cybersecurity risk-management measures every in-scope organization must implement:

Risk analysis and information system security policies
Incident handling
Business continuity (backup, disaster recovery, crisis management)
Supply chain security — including direct supplier relationships
Security in network and information systems acquisition, development, and maintenance (vulnerability handling and disclosure)
Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
Basic cyber hygiene practices and cybersecurity training
Cryptography and encryption policies
Human resources security, access control policies, asset management
Multi-factor authentication, secured communications, secured emergency communications

Article 23 mandates incident notification:

Initial notification within 24 hours of becoming aware of a significant incident
Update within 72 hours
Final report within 1 month

Article 32-34 sets penalties:

Up to €10 million or 2% of global annual revenue (whichever is higher) for essential entities
Up to €7 million or 1.4% for important entities
Personal liability for management bodies — directors and officers can be held accountable

The supply chain time bomb

Here's the part most SaaS vendors are missing. NIS2 Article 21(2)(d) requires in-scope organizations to address supply chain security. That means evaluating, monitoring, and contractually binding their suppliers — including SaaS vendors.

Your EU enterprise customers are obligated to:

Inventory all suppliers (including SaaS) and assess their cybersecurity posture
Include cybersecurity requirements in contracts with suppliers
Monitor suppliers' compliance with those requirements
Include suppliers in their incident response plans
Report incidents originating from supplier compromise

What this means for you, the SaaS vendor: Even if NIS2 doesn't apply to you directly, your enterprise customers will push their obligations down to you through:

Vendor security questionnaires — much longer, much more specific than what you're used to
Contract clauses — security commitments, audit rights, incident notification SLAs (often 24h)
Penetration test requirements — annual third-party pentests, with reports made available
SBOM requirements — Software Bill of Materials for the components in your stack
Right-to-audit clauses — your customer's auditors may need access to your systems
Termination rights for security failures
Sub-processor approval rights — you may need to notify and get approval before adding new sub-processors

What your EU customers will ask you

Within the next 6-12 months, expect questionnaires that look like this:

Governance

Do you have documented information security policies? Provide them.
Who owns information security at the executive level?
Have you appointed a CISO?
Do you carry out an annual risk assessment?

Technical controls

Do you encrypt data in transit and at rest? What algorithms?
Do you enforce MFA for all administrative access?
Do you use a zero-trust network architecture?
How do you handle vulnerability management? What's your patching SLA?
Do you maintain an SBOM?
What's your secrets management approach?

Identity & access

How do you provision and de-provision user access?
Do you have role-based access control?
How often do you review access rights?
How do you handle privileged access?

Supply chain

Provide your sub-processor list with locations and DPAs.
How do you assess your own suppliers?
How do you notify customers when you add a sub-processor?
Do you have a Software Bill of Materials for your stack?

Incident response

Do you have a documented incident response plan?
What's your incident notification SLA to customers?
How quickly do you confirm an incident? Investigate? Contain?
Have you had a security incident in the past 24 months? If yes, describe.

Business continuity

Do you have a documented disaster recovery plan?
What's your RTO and RPO?
When did you last test your DR plan?
Do you have offsite backups? Encrypted?

Compliance certifications

Do you have SOC 2 Type II?
Do you have ISO 27001 certification?
Do you have a GDPR DPA available?
Do you participate in any cyber assurance schemes (Cyber Essentials, BSI C5, etc.)?

If you can't answer "yes, here's the document" to most of these, you'll be deprioritized in procurement — or excluded entirely.

How to get ready (without becoming a compliance shop)

You don't need to become NIS2-compliant yourself unless you're directly in scope. You need to be NIS2-procurement-ready — meaning you can credibly answer the questions your customers will ask.

Here's the practical playbook:

1. Start with a risk assessment

Document the cybersecurity risks your SaaS faces — data breach, account takeover, supply chain compromise, DDoS, insider threat, AI model risks. Score them by likelihood and impact. This single document answers half the questionnaire.

2. Get SOC 2 Type II or ISO 27001 (or both)

A SOC 2 Type II report or ISO 27001 certification answers ~70% of NIS2 procurement questions in one shot. If you're not started yet, start now — Type II requires a 6-12 month observation period. ISO 27001 takes 6-12 months to implement. Your EU customers won't wait.

If you're picking one: ISO 27001 is more recognized in Europe. SOC 2 if you also sell to U.S. enterprises. See our SOC 2 vs ISO 27001 guide.

3. Build a public-facing trust center

A page like yoursaas.com/security or yoursaas.com/trust listing:

Your certifications
Your sub-processors
Your incident notification process
Your DPA (downloadable)
Your contact for security questions

This deflects 80% of inbound security questionnaires. Procurement teams check the trust center first; only if you don't have one do they send the 200-question spreadsheet.

4. Document your incident response process

Even if you've never had an incident, write down:

Who's on the response team
How you classify incident severity
Your customer notification SLA (commit to 24 hours to match NIS2 expectations)
Your post-incident review process

Then practice it with a tabletop exercise at least once a year.

5. Maintain a real sub-processor list

Public, dated, with notification commitment for changes. List vendor name, purpose, data location, link to their DPA. NIS2-aware procurement teams check this before they sign.

6. Automate evidence collection

The single biggest pain in NIS2-driven procurement is evidence gathering. Every question wants a screenshot, a policy doc, a config export. A GRC platform that pulls evidence from your existing tools (cloud platform, IdP, SIEM, EDR) on a continuous schedule means a 30-minute questionnaire response, not a 30-hour one. See our guide on automated evidence collection.

7. Get a vCISO or compliance partner

NIS2 procurement is a moving target. Member state implementations differ. Sector-specific guidance is evolving. A vCISO or compliance partner who tracks this for a living will save you months of trial and error.

Bottom line

NIS2 is here. Your EU customers are figuring out what they owe and pushing it onto their suppliers. The SaaS vendors who answer "yes, here's the document" will win the next 18 months of European deals. Those who scramble will be excluded from procurement entirely.

The work is straightforward but it takes time. Start now. A SOC 2 Type II audit, an ISO 27001 implementation, or a credible trust center built today is what wins the deal in Q4 2026.

Need help getting NIS2-procurement-ready? Radius360 is the GRC platform built for vCISOs and MSSPs supporting growing companies through compliance frameworks like ISO 27001, SOC 2, NIS2, and GDPR — with automated evidence collection, sub-processor management, and a public trust center. Start a free trial or explore our compliance frameworks.

NIS2 Compliance for SaaS Vendors: What Your EU Customers Will Demand