A contracting authority that is itself subject to the NIS2 Directive may not limit its duty of care to its own organisation. That duty extends across the supply chain: the contracting authority must assess what risks suppliers bring with them, and this translates into contractual requirements. For the metal and manufacturing industry, this often concerns not only office automation, but also machines, control systems and production lines that are connected in some way to the contracting authority's network or to the internet.
The most common requirements concern access, network segregation, update policies and the reporting of incidents to the contracting authority itself — separate from the legal reporting obligation that applies only to entities subject to the Directive. Below is a description of which provisions are found in practice and what they mean for a production environment.
Which provisions are found in the contract
Contracts reviewed after NIS2 typically contain a combination of obligations: the right to send periodic questionnaires, an incident reporting deadline for events affecting the contracting authority's service, an obligation to demonstrate security measures, and sometimes an audit right. Wording varies considerably between contracting authorities and sectors; there is no standard text that applies to all contracts. To get a clearer picture of what is reasonable to ask and what is not, it helps to consult the most frequently asked questions about what a buyer may ask .
Important to distinguish: the contracting authority requests this based on its own duty of care, not because the supplier itself is subject to the Directive. A machine builder or supplier in the metal and manufacturing industry can thus receive contractual requirements without being essential or important itself. Whether this applies to a specific relationship depends on the sector and size of the contracting authority and on the role the supplier plays in that chain.
What this means for production systems on the network
In the metal and manufacturing industry, the combination of IT (office automation) and OT (operational technology such as CNC machines, PLCs and production lines) is a recurring focus in questions that contracting authorities ask. Machines that are remotely accessible for maintenance, or that transmit production data to a cloud environment, fall under the same scrutiny as a laptop in an office.
Separation between office and production network
A recurring question is whether the production network is separated from the office network, and whether a fault or infection on one network can spread to the other. This is not a question answered with yes or no in a questionnaire alone; regulators and contracting authorities look at the actual configuration, not at an intent statement.
Remote access for maintenance
Many machines in the metal and manufacturing industry are maintained remotely by the machine supplier itself, sometimes via a permanent connection that is continuously open. Contractual requirements often focus specifically on this point: who has access, how is that access logged, and can it be revoked at any time. This affects both the supplier building the machine and the company using the machine.
What contracting authorities ask as proof
In addition to the questionnaire itself, a contracting party often requests some form of substantiation: a policy document, an overview of who has access to which systems, or a statement on how updates are handled. A certificate or audit report may be requested, but is not in itself a legal obligation under NIS2 — that is a choice of the individual contracting party. For those who wish to assess how those contractual requirements relate to their own position in the supply chain, it is useful to first check in a few questions where your organization stands.
What you can do with it yourself
Most requirements that appear in contracts for the metal and manufacturing industry derive from the ten risk management measures in the directive: access control, network segmentation, incident recording and recovery plans all feature, but tailored to the question the contracting party asks. An overview per situation, including topics specific to production environments, can be found in the overview of topics per sector and situation.
For the precise wording of a contract, and for the question of whether a specific requirement is reasonable in relation to the relationship, legal advice remains the appropriate route; this article describes the patterns that recur, not the answer to an individual contract. More on where the information on this site comes from and how it is maintained can be found on the page on how we maintain sources.
Would you like to quickly see whether your organization is affected through the supply chain, and what the next step is? The free NIS2 check gives you initial direction on this in a few questions, without needing an account.