EU NIS2 Supply-Chain Security Pages on Changzhou Manufacturer Websites: How Should They Be Accepted?

Direct answer: The EU NIS2 Directive (Directive (EU) 2022/2555) is not covered by "get ISO 27001/fill in a questionnaire". Member States had to transpose it by 17 October 2024; it covers medium/large entities in 18 critical/important sectors and requires risk management, supply-chain security, management accountability, registration and incident reporting (24-hour early warning, 72-hour notification, 1-month final report). For Chinese manufacturers, it usually does not apply directly; instead, as a supplier to EU customers/essential entities, they face "NIS2 supply-chain security" requirements in contracts/questionnaires/audits; if they provide services in the EU without establishment, a Member State may require a representative. A manufacturer's NIS2 supply-chain page should state scope/role, security measures, supply-chain requirements, incident reporting, evidence and customer questionnaires—not just "ISO 27001/cybersecurity compliant".

This guide is for equipment, electrical/electronic, industrial software, medical device, automotive, energy equipment, cloud/IT service and export manufacturers in Changzhou and nearby areas. It explains how to write and accept a NIS2 supply-chain security page. Information is current to 2026-11-05. It is a review of public rules and project practice, not EU legal, cybersecurity, audit or compliance advice; the specific scope, duties, reporting, penalties and national transposition depend on the directive, Member State law, the competent authority and the customer contract.

How does the NIS2 page relate to CRA, GDPR, ISO 27001, DORA and cyber-law pages?

The CRA page answers product (with digital elements) cybersecurity; GDPR answers personal data; the information-security/data-exchange page answers NDAs/permissions/encryption; DORA answers financial entities' digital operational resilience; China's Cybersecurity Law/Data Security Law answer China obligations. The NIS2 page answers "as a supplier to an EU essential/important entity, or as an entity providing services in the EU, which organisational/supply-chain/reporting requirements apply". NIS2 is organisation/service-level; CRA is product-level; they can stack; ISO 27001 is a system standard, not NIS2 proof.

Common breakpoints: treating ISO 27001 as NIS2; treating CRA as NIS2; writing "cybersecurity" without supply chain/reporting; assuming a Chinese factory is directly in scope; ignoring customer questionnaires/contracts; no incident process; selling "NIS2 certification". A page that states scope, role, measures, reporting and evidence gives sales, quality, IT and legal one playbook.

This page map is editorial; NIS2 duties follow Directive (EU) 2022/2555 and the European Commission NIS2 page.

Which sectors/entities are in scope?

NIS2 covers 18 critical/important sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal/courier, waste management, chemicals, food, manufacturing (including medical devices, computer/electronics, machinery, motor vehicles, etc.), digital providers and research. It generally applies to medium/large entities (≥50 staff, or turnover/balance sheet >€10m; per Member State law), with some entities regardless of size; divided into "essential" and "important". Member States may broaden/tighten. Chinese manufacturers are usually not established in the EU, so direct application is limited; as suppliers they face customer requirements, and if providing services in the EU without establishment, a Member State may require a representative.

Acceptance checks: sector/sub-sector; size; essential/important; national transposition; EU establishment/services; whether the customer is an essential entity; contract/questionnaire requirements. Common gaps: assuming a Chinese factory is directly in scope; missing the "manufacturing" sub-sectors; wrong size; not distinguishing essential/important; not checking Member State differences; not incorporating customer requirements.

Scope/size/category follow NIS2 Articles 2–3, the annexes and national transposition; confirm specific entities with legal/compliance.

How should essential/important entities and penalties be described?

"Essential" entities (e.g. energy, transport, banking, health, digital infrastructure, public administration) face stricter supervision; "important" entities (e.g. postal, waste, chemicals, food, manufacturing, digital providers, research) have similar duties but lighter supervision/penalties. Penalties are set by Member States: essential entities commonly up to €10m or 2% of global turnover, important entities commonly up to €7m or 1.4% (per national law); management may be held accountable. NIS2 has no "certification"; registration/self-assessment/authority lists vary by Member State.

Acceptance checks: category; regulator; registration; penalties; management responsibility; Member State differences. Common gaps: treating important as essential; not knowing the authority; not registering; underestimating penalties; management not involved; assuming a certificate.

Categories/penalties follow NIS2 Articles 32–34 and national law; specific amounts/procedures follow national law.

How should risk management and management accountability be accepted?

NIS2 requires appropriate/proportionate technical, operational and organisational measures, commonly including: risk analysis/security policy, incident handling, business continuity/backup/disaster recovery, supply-chain security, vulnerability management/disclosure, encryption, access control/MFA, asset/identity management, security training, penetration testing/audit, logging/monitoring. Management must approve/oversee measures, receive training and be accountable for non-compliance. Measures should be proportionate to risk/size, not "buy a tool".

Acceptance checks: risk analysis; security policy; incident handling; BCP/backup; vulnerability management; encryption/MFA; access control; training; audit/testing; management approval. Common gaps: firewall/antivirus only; no risk analysis; BCP untested; vulnerabilities unpatched; incomplete MFA; token training; management not signing.

Measures follow NIS2 Articles 20–21, national law and competent-authority guidance; the baseline depends on risk/size.

How should supply-chain security be accepted?

NIS2 explicitly requires security in supplier/customer relationships: assess supplier/service-provider vulnerabilities, product quality, cybersecurity practices, incident handling, access/data protection and business continuity; contracts should state security requirements/notification/audit/termination; critical suppliers need due diligence/tiering; requirements should flow down (flow-down). As a Chinese supplier, you must answer questionnaires, provide evidence and agree incident notification/remediation. Supply-chain security is not "sign an NDA".

Acceptance checks: supplier list/tiering; due diligence/questionnaire; contract clauses; incident notification; access/data; BCP; audit rights; flow-down; remediation. Common gaps: NDA only; no due diligence; no security clauses; incidents not notified; critical suppliers not audited; requirements not passed down; remediation not tracked.

Supply-chain requirements follow NIS2 Article 21(2)(d), national law and the customer contract; due diligence/clauses depend on risk.

How should 24/72-hour incident reporting be accepted?

NIS2 significant-incident reporting generally has three stages: early warning within 24 hours (suspected malicious/cross-border impact), incident notification within 72 hours (assessment/severity/indicators), final report within one month (root cause/measures/cross-border impact); interim/progress reports may be required. Report to the CSIRT/competent authority (per Member State law); customer contracts may set shorter deadlines. Distinguish discovery/confirmation/reporting clocks; keep timelines/evidence; late/non-reporting can be penalized.

Acceptance checks: process/owner; 24/72/1 month; CSIRT/authority; customer notification; timeline; templates; drill; records. Common gaps: unaware of 24 hours; customer-only; no template; wrong clock; no drill; missing records; cross-border not reported.

Reporting deadlines/recipients follow NIS2 Article 23, national law and the competent authority; customer contracts may be stricter.

How should the incident-reporting timeline be planned?

Example: T0 discover/confirm a significant incident → activate incident response/forensics/containment → early warning within 24 hours → incident notification within 72 hours → interim/progress per authority → final report within one month → customer/contract notice → review/remediation. Each node needs an owner/template/receipt/evidence; cross-border/multi-entity incidents need coordination; do not wait for "full clarity" before the early warning.

Acceptance checks: timeline; owner; templates; receipts; customer notice; review; drill. Common gaps: waiting for root cause; customer-only; no template; no cross-team coordination; no drill; remediation not tracked.

This timeline is an editorial example; specific deadlines/recipients follow NIS2, national law and the competent authority.

What will customer questionnaires ask?

Common: company/scope/whether a NIS2 entity; security governance/policy; assets/access/MFA; vulnerabilities/patching; incident handling/reporting; BCP/backup; supply chain/subcontracting; data protection/encryption; secure development/SBOM; cloud/hosting; audit/certification (ISO 27001/SOC 2); insurance; contract terms; remediation plan. Answers must be truthful/evidence-based; do not answer "Yes to everything" without evidence; explain non-applicable items; provide a plan/timeline for gaps. Customers may require on-site/remote audits, pen-test summaries and incident-notification SLAs.

Acceptance checks: questionnaire library; evidence mapping; non-applicable explanations; gaps/plan; audit; SLA; version. Common gaps: all Yes; no evidence; no non-applicable explanation; no gap plan; outdated questionnaire; inconsistent answers across customers.

Questionnaire items are editorial; specifics follow the customer/authority questionnaire and contract.

How should contracts and flow-down be accepted?

Contracts can include: security requirements/baseline; incident notification deadlines/contacts; vulnerability/patch/disclosure; access/data/encryption; subcontracting/cross-border transfer; BCP/exit; audit rights/questionnaires; remediation/termination; liability/compensation; passing NIS2/customer requirements to sub-tiers; certification/evidence. As a supplier, distinguish "what we can commit" from "what the customer/Member State law requires"; do not promise the customer's NIS2 compliance. Contracts/questionnaires/evidence must be consistent.

Acceptance checks: security clauses; incident SLA; vulnerability/disclosure; access/data; subcontracting; BCP/exit; audit; remediation/termination; flow-down; liability. Common gaps: no security clause; unclear SLA; subcontracting not passed down; audit refused; no remediation deadline; liability too high/low.

Contract clauses are editorial; specifics follow the customer contract, national law and legal advice.

How should the website NIS2 supply-chain page be written?

A public page should include: applicable customers/role (supplier/provider), security governance/measures, supply-chain security, incident reporting 24/72/1 month, data/access/encryption, BCP/backup, certification/audit (ISO 27001/SOC 2 with scope), customer questionnaires/evidence, contracts/flow-down, contact/version. Write verifiably: state "we have measures/processes/evidence", not "NIS2 certified/fully compliant/zero incidents".

Separate "public information" from "customer/sensitive documents": security policies, pen-test reports, incident records and questionnaire answers are provided per permission/contract; the public page gives scope, measures, process and contacts, and does not publish vulnerabilities/customer/incident sensitive data. If only a supplier, state that the company supports EU customers/essential entities with NIS2 supply-chain evidence and does not declare the customer compliant. Multilingual pages should match sales countries.

This page structure is editorial; external claims must be truthful and verifiable, per NIS2, national law and the customer contract.

What must not be written?

High-risk claims: "NIS2 certified/fully compliant" (no unified certification); "ISO 27001 = NIS2" (system ≠ legal compliance); "Chinese factories are directly subject to NIS2" (usually via customers/contracts, limited direct application); "zero incidents/absolutely secure" (cannot guarantee); "an NDA satisfies supply-chain security" (due diligence/contracts/evidence also needed); "all incidents are reportable within 24 hours" (significant incidents/Member State law); "customer compliance = our compliance" (separate duties); "yes to every questionnaire" (needs evidence/gaps). These are inaccurate or misstate responsibility.

Safer wording: "as a supplier, support NIS2 supply-chain evidence, measures/processes/reporting/contracts/certification scope, subject to NIS2/national law/customer contract". External promotion must also comply with advertising/fair-competition law; customer/vulnerability/incident information needs authorisation/redaction.

These red lines are editorial; whether a claim is false advertising/non-compliant is determined by regulators and the contract, and this is not legal advice.

Go-live acceptance checklist

Ten checks: scope/role, governance/risk measures, supply-chain security, incident reporting 24/72/1 month, data/access/encryption, BCP/backup, certification/audit scope, customer questionnaire/evidence, contracts/flow-down, page wording/version. Each needs an owner, evidence and review date. The pass condition is not "the page says NIS2", but that a customer/authority can see your role, measures, reporting process and evidence.

Before go-live, run one real customer questionnaire/contract through: scope → governance → supply chain → incidents → data/BCP → certification → questionnaire → contract → page wording. Any step that fails is a gap in the page or the process.

This checklist is editorial; specific compliance requirements follow NIS2, national law, the competent authority and the customer contract.

Who should read this, who should not, and what decisions does it support?

It suits sales, IT/security, quality, legal and website teams at equipment, electrical/electronic, industrial software, medical device, automotive, energy equipment, cloud/IT service and export manufacturers in Changzhou and nearby areas; also companies supplying EU essential/important entities or receiving NIS2 questionnaires/contract requirements. It does not suit businesses that do not sell to the EU, do not touch essential-entity customers, or want one page to replace NIS2/legal/security-audit advice.

Read it if an EU customer requires a NIS2 questionnaire/contract; you supply essential entities; you provide services in the EU; you are building or revising a NIS2 page; or you need to separate NIS2, CRA, GDPR, ISO 27001 and DORA. Skip it if you treat ISO 27001 as NIS2, claim certification, or rely on an NDA. It supports self-review of scope, measures, supply chain, reporting, evidence, contracts and page wording.

FAQ

Does NIS2 apply to Chinese manufacturers?

NIS2 mainly applies to essential/important entities established in EU Member States; Chinese manufacturers are usually not directly covered, but as suppliers to EU customers/essential entities they face NIS2 supply-chain requirements in contracts/questionnaires. If providing services in the EU without establishment, a Member State may require a representative (per national law). Confirm with legal/compliance.

Which sectors/sizes are in scope?

18 critical/important sectors (energy, transport, banking, health, water, digital infrastructure, ICT, public administration, space, postal, waste, chemicals, food, manufacturing, digital providers, research, etc.); generally medium/large (≥50 staff, or turnover/balance sheet >€10m, per national law), with some entities regardless of size; divided into essential/important.

What is 24/72-hour reporting?

NIS2 significant incidents generally require an early warning within 24 hours, incident notification within 72 hours and a final report within one month (interim/progress may be required); report to the CSIRT/competent authority (per national law); customer contracts may be shorter. Distinguish discovery/confirmation/reporting clocks and keep timelines/evidence.

What does supply-chain security require?

Assess supplier/provider vulnerabilities, product quality, security practices, incident handling, access/data and BCP; contracts should state security/notification/audit/termination; critical suppliers need tiering/due diligence; requirements should flow down. As a Chinese supplier, answer questionnaires, provide evidence and agree incident notification/remediation.

What is the difference between NIS2, CRA and ISO 27001?

NIS2 is organisation/supply chain/reporting; CRA is product (with digital elements) cybersecurity; ISO 27001 is an ISMS standard. ISO 27001 helps but is not NIS2 compliance proof; NIS2 has no unified "certification".

How should the website/customer statement be written?

State applicable customers/role, governance/measures, supply-chain security, 24/72/1-month reporting, data/access/encryption, BCP, certification/audit scope, questionnaires/evidence, contracts/flow-down and contact/version; do not write "NIS2 certified/fully compliant/zero incidents/ISO = NIS2". Customer/vulnerability/incident documents are provided on a need-to-know basis.

One-sentence takeaway

A Changzhou manufacturer's NIS2 supply-chain page is not about the words "ISO 27001/cybersecurity". It should turn scope/role, governance/risk measures, supply-chain due diligence/contracts, 24/72/1-month incident reporting, data/access/BCP, certification scope, customer questionnaires and flow-down into a verifiable checklist—so a customer/authority can see your role, measures, reporting and evidence.

Method and limitations

This is a review of public rules and project practice, not an audit or legal opinion on any company's cybersecurity, NIS2, audit or compliance. No undisclosed customer/vulnerability/incident data were used. Scope, measures, supply chain, reporting, evidence and acceptance items are editorial suggestions, not security/legal conclusions. Specific scope, duties, reporting, penalties and national transposition depend on the directive, national law, the competent authority and the customer contract.

Sources and scope

Information is current to 2026-11-05. The following are EU official/legal pages; their articles, transposition laws and guidance control.

1. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), adopted 14 December 2022, published 27 December 2022: EUR-Lex. Scope, risk measures, supply chain, reporting, supervision and penalties.
2. European Commission, NIS2 Directive: European Commission. 18 sectors, essential/important, transposition and the 2026 amendment proposal.
3. European Commission, NIS2 Q&A: European Commission. Scope/duties/reporting interpretation.
4. European Commission, NIS2 transposition: European Commission. Member State transposition progress.
5. European Commission, NIS Cooperation Group: European Commission. Implementation guidance/coordination.