Law / Frameworks / ENISA NIS2 guidance / Supply chain security
ENISA NIS2 guidance 5.1Supply chain security policy
For the purpose of Article 21(2), point (d) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a supply chain security policy which governs the relations with their direct suppliers and service providers in order to mitigate the identified risks to the security of network and information systems. In the supply chain security policy, the relevant entities shall identify their role in the supply chain and communicate it to their direct suppliers and service providers.ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, 5.1
We read each law below as bearing on this requirement. That does not mean the requirement, done well, meets the law: what each law asks is on its own page. Law library as of .
The kinds of duty that reach it: breach notice, contract terms.
- 1
- law
- 1
- jurisdiction
- 0
- with court rulings behind them
- 0
- not yet in force
Vulnerability and incident reporting
1 law, 1 jurisdiction| Jurisdiction | Law | How it reaches this requirement |
|---|---|---|
 Gambia |
Information and Communications Act, 2009, security of information and communications services (subscriber risk notification) |
Through its breach notice duty. What it requires |
Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced. Every requirement of the framework.