NIS2 and Cyber Intelligence: Why Questionnaires Are No Longer Enough

What NIS2 Art. 21(d) Really Requires

NIS2 Art. 21(d) mandates 'supply chain security' as one of ten minimum measures. The BSI interpretation is clear: sending annual questionnaires is insufficient. What is required is risk-based, continuous management of all critical suppliers — with documented assessment, ongoing monitoring and demonstrable measures when risks are identified.

The Questionnaire Problem

Questionnaires measure self-disclosure — not the actual security situation. A supplier can answer all questions correctly and still have unpatched critical CVEs, leaked credentials on the dark web or active ransomware indicators.

Cyber Intelligence as NIS2 Evidence

Darkscope provides the technical foundation for NIS2-compliant supply chain security: daily external security assessment of all suppliers, automatic documentation of all monitoring results, immediate alerts on risk increases, and audit-ready evidence for BSI inspections.

Frequently Asked Questions