The supply chain is now yours
NIS2 Art. 21 makes supply-chain security part of your duties. In ENISA's 2025 survey of EU organisations, 37% named it one of the hardest areas to meet.
Roles · CISO & IT security
Show the board where you stand. Your suppliers too.
NIS2 puts security on the management agenda and the supply chain in your scope. Paragraf connects your controls, your supplier contracts and the evidence, so a thin team spends less time collecting and more time securing.
NIS2DORAISO 27001Supply chainIncident reporting
Supplier · CloudOps AB
- Supports a critical serviceYes
- Security clauses7 of 9
- OwnerIT security
- Next reviewIn 30 days
The pressure
A bigger scope. The same team.
Fewer people, more paperwork
Only 11% of security leaders say their team is adequately staffed (IANS, 2025). Hours go to questionnaires and spreadsheets instead of security.
The board wants a status
Boards rank compliance status as a top security metric far more often than CISOs do (Splunk CISO Report, 2025). Someone has to put it together.
How it works
Example: a critical supplier's contract lacks security clauses.
Step 1 of 4
The gap shows up before the audit does.
Supplier contracts are checked against your list of required security clauses for NIS2 and DORA. Two are missing.
Contract · CloudOps AB
- Required clauses9
- Found7
- MissingIncident notice, audit rights
Step 2 of 4
Legal gets the task, with the clause.
An addendum with your approved wording goes to the contract owner in Legal. You can see where it stands.
Addendum
- OwnerLegal counsel
- ClausesFrom your playbook
- Due14 days
Step 3 of 4
The signed addendum becomes evidence.
When the supplier signs, the addendum attaches itself to your supplier control. Nothing to file by hand.
Evidence
- Linked toSupplier security
- SignedElectronically
- LoggedYes
Step 4 of 4
The board sees the whole chain.
A live view shows which critical suppliers are covered, what is missing and who is on it.
Board report · Suppliers
- Critical suppliers43
- Fully covered41
- In progress2, with owners
Works with or without Luis. Your team can check contracts against the clause list by hand. Luis does the first pass and points to the exact text it found, or did not find.
Check yourself
Five questions. Two minutes.
Answer honestly. You get one recommended place to start. Nothing is saved or sent.
Where most teams like yours start
Supplier contracts under NIS2 and DORA
Most security teams start where the risk is least visible: what you have already signed with your suppliers.
Before you decide
Make it a safe decision.
- Hosted in the EUOr on your own servers, with local AI.
- Permissions and a full logEveryone sees only what they should. Every change is logged.
- Your questionnaire, answeredWe answer your security review in writing before you decide.
- Start with one scopeFor example your critical suppliers, with acceptance criteria agreed up front.
Is this another tool my team has to run?
No. It replaces the spreadsheets and email threads you run today. Owners get tasks when it is their turn, so your team stops chasing.
We already have a GRC or ISMS tool.
Keep what works. Paragraf adds what those tools rarely have: the link to supplier contracts, processes and training, so evidence comes from the work itself.
Where does the data go, and how does the AI handle it?
Data is hosted in the EU, or on your own servers where the AI also runs locally. Everything follows your permissions and sensitive data is masked on the server. We describe how AI handles your data in writing.
Which certifications do you hold?
ISO 27001 is in progress, as are ISO 9001 and ISO 14001. We tell you exactly where we are rather than claim what we don't have yet. See the Trust center.
For the buying group
What you can tell the others.
You rarely decide alone. One foundation means each colleague gets their own part, and everyone sees the same truth.
- To ComplianceSecurity controls and evidence in the same model as every other requirement.
- To LegalMissing security clauses become tasks with your approved wording.
- To managementYou approve the measures under NIS2. Now you can see them, live.
- To ProcurementSecurity requirements are part of the supplier contract from the start.
- To the CFOFewer tools and less manual work for a team that is hard to hire for.
Send a short summary to a colleague.
Go deeper
- Supplier contracts under NIS2 and DORAFind the gaps in what you have signed→
- Prepare for NIS2Duties mapped, owners assigned, evidence ready→
- How we secure ParagrafHosting, permissions, logging and AI→
Next step
Secure the whole chain.
Book a walkthrough with your own suppliers and requirements. We show you the gaps and the evidence, on your material, before you decide anything.