An organization's security is only as strong as the weakest link in its supply chain. The amendment to the KSC Act (implementing the NIS2 directive) imposes on key and important entities the obligation to manage risk in relationships with suppliers of ICT products and services. This means that legal and operational liability for IT breaches does not end at the boundaries of the company's own infrastructure, but extends to external providers of software, cloud, infrastructure, and managed services.
Why has the supply chain come under the regulator's microscope?
Supply chain attacks have become one of the primary vectors for breaching security in digital infrastructure. Under the new regulations, entities subject to the KSC regime must consider the specific vulnerabilities of each direct supplier and the overall quality of their cybersecurity products and practices. Failure to verify a supplier is treated by the supervisory authority as equivalent to failure to implement its own security measures.
What needs to change in B2B contracts with ICT suppliers?
Existing standard B2B contracts often limit IT vendor liability to nominal amounts and contain only superficial security declarations. The new KSC regime requires the introduction of strong, enforceable contractual clauses, including, in particular:
- Right to Audit:Guarantee of the right of the ordering party (and supervisory authorities) to conduct security audits at the supplier's premises or to verify its IT environment.
- Strict incident reporting obligations: The supplier is obligated to immediately notify of incidents on its side that may affect the continuity or security of the service provided (taking into account time windows allowing the contracting authority to meet its own 24-hour reporting obligation).
- Minimum technical and organizational standards: Precise definition of requirements for data encryption, permission management, multi-factor authentication and conducting periodic penetration tests.
- Cascading obligations (sub-subcontractors): An order to impose similar cybersecurity requirements on sub-suppliers and sub-contractors used by the main contractor.
How to effectively audit ICT contractors?
Supplier verification cannot be limited to a one-time collection of declarations. According to KSC guidelines, this process must take the form of a cyclical risk assessment, consisting of:
- Supplier Categorization: Dividing contractors into groups based on their level of access to the organization's critical systems and data.
- Verification of certifications and standards: Checking whether the supplier has recognized market certifications (e.g. ISO/IEC 27001, SOC 2) and enforcing detailed self-assessment surveys.
- Operational Reviews: Regularly review SLA metrics and request independent security test results.
- Business Continuity Planning: Analyze your provider's BCPs in the event of a disaster, ransomware attack, or sudden service termination.
Implementing new ICT supplier oversight rules requires close collaboration between legal, purchasing, and IT departments. The remaining time until April 2027, the deadline for full implementation of a cybersecurity risk management system, should be used for a comprehensive review of the B2B contract portfolio and the implementation of audit procedures before these issues are verified during the regulator's first inspection.
This article is for informational purposes only and does not constitute legal advice.
The law is current as of September 10, 2026.
