NIS2 vendor risk management: the complete guide for Danish utilities
How Danish water, wastewater, district heating and energy utilities assess suppliers, write NIS2-ready contracts and meet the 24-hour reporting deadline when an incident starts at a vendor.
In May 2023, attackers broke into 22 companies that run parts of Denmark's energy infrastructure. They didn't need to phish anyone. According to SektorCERT's report on the attack, they exploited vulnerabilities in firewalls supplied by a third-party vendor, and several of the companies had to cut their internet connection and run in island mode. In December 2024, a small waterworks near Køge lost control of its pumps and 450 households briefly lost their water supply. The Danish Defence Intelligence Service has since attributed that attack to a pro-Russian group.
Both cases point the same way. In a utility, a large share of the cyber exposure sits with suppliers, such as the SCADA integrator, the managed IT provider, the firewall and VPN vendor and the contractor who maintains pumping stations remotely. NIS2 turns managing that exposure into a legal duty. On 24 September 2026, Styrelsen for Samfundssikkerhed raised the threat level for destructive cyberattacks against Denmark from medium to high, naming attacks that manipulate operational technology (OT) as a main concern.
This guide is for compliance, IT and information security leaders in Danish utility companies. It explains what the law requires, which of Denmark's two rulebooks applies to you, an eight-step workflow for NIS2 vendor risk management, the contract clauses that make the 24-hour reporting deadline achievable and the documentation a supervisor will expect. New to the directive? Start with our introduction to NIS2 or the NIS2 implementation guide.
The short answer: what NIS2 expects from your supplier management
NIS2 requires you to secure your relationships with direct suppliers and service providers (article 21(2)(d) of the NIS2 Directive). You must take each supplier's specific vulnerabilities and the quality of its security practices into account (article 21(3)), and your management body must approve and oversee those measures (article 20).
- Suppliers aren't bound by your obligations directly. You bind them through contracts, due diligence and monitoring.
- You stay responsible for reporting. If an incident starts at a supplier, the 24-hour early warning is still yours to send.
- Denmark has two rulebooks for utilities. Drinking water and wastewater follow the Danish NIS2 law, supervised by Miljøstyrelsen. Electricity, gas and district heating follow the energy-sector rules in executive order no. 260 (BEK 260), supervised by Energistyrelsen.
- The energy rules are more specific. BEK 260 §§ 29-32 set out what supplier contracts must contain, including incident notification and help with your own reporting.
Why suppliers are the weak point in a utility
Utilities depend on a small group of specialist vendors that few other sectors use. A district heating plant or a waterworks often relies on one integrator for its control system, and that integrator usually needs remote access to do its job. Three patterns make this risky.
- Remote access into OT. VPN gateways, firewalls and remote support tools face the internet. The 2023 energy-sector attack went through exactly this kind of edge device.
- Concentration. Smaller utilities and cooperatives may have a single supplier who designed, installed and maintains the whole control system. If that supplier is compromised or goes out of business, there's no easy fallback.
- Long equipment lifetimes. PLCs and SCADA components run for decades and often can't receive security updates once the vendor stops supporting them.
ENISA's Threat Landscape 2025 reports hacktivist groups claiming attacks on internet-facing OT interfaces in energy and water, and it flags compromised service providers as a recurring way in. ENISA also notes that the hacktivist OT attacks it reviewed didn't cause significant operational impact. The risk is real, but basic supplier controls remove a lot of it.
What NIS2 says about suppliers, article by article
| Provision | What it requires | What it means for vendor management |
|---|---|---|
| Article 20 | Management approves and oversees the risk-management measures, can be held liable and must follow training | The board approves the supplier security policy and receives reporting on critical suppliers |
| Article 21(2)(d) | Supply chain security, including security aspects of relationships with direct suppliers and service providers | You need a policy, a supplier register and security requirements in contracts |
| Article 21(3) | Consider vulnerabilities specific to each direct supplier, the quality of its products and its security practices, including secure development | Due diligence must be supplier-specific, not one generic questionnaire |
| Article 22 | Coordinated EU risk assessments of critical ICT supply chains | Take the results into account when they cover products you buy |
| Article 23 | Early warning within 24 hours, incident notification within 72 hours, final report within one month | Suppliers must give you information fast enough to meet these deadlines |
| Article 34 | Maximum fines of at least €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities | Weak contracts and missing monitoring can lead to sanctions |
Implementing Regulation 2024/2690: the most useful benchmark
Commission Implementing Regulation (EU) 2024/2690 sets out detailed technical requirements, but it binds only certain digital providers, such as cloud, data centre, managed service and managed security service providers. It doesn't apply to utilities directly. It's still the most concrete EU description of supply chain security in practice, and many of your IT suppliers are bound by it, so you can ask them for the evidence they already produce.
Its annex covers four elements worth borrowing. A supply chain security policy. Criteria for selecting suppliers, including their security practices and your ability to avoid lock-in. Contract requirements, including a duty for suppliers to notify you of incidents without undue delay. And an up-to-date register of direct suppliers. ENISA's technical implementation guidance from June 2025 adds examples of evidence and recommends reviewing both the policy and the register at least once a year.
Two rulebooks in Denmark: which one applies to your utility?
Denmark didn't implement NIS2 for utilities in a single law. The Danish NIS2 law (lov nr. 434 of 2025, in force since 1 July 2025) covers most sectors, including drinking water and wastewater. It doesn't apply to entities covered by the act on strengthened preparedness in the energy sector, which implements NIS2 for electricity, gas, district heating and hydrogen through executive order no. 260 of 6 March 2025.
| Topic | Drinking water and wastewater | Electricity, gas and district heating |
|---|---|---|
| Legal basis | The NIS2 law (lov nr. 434/2025) | The energy-sector preparedness act and BEK 260 |
| In force | 1 July 2025 | March 2025 |
| Supervisor | Miljøstyrelsen | Energistyrelsen |
| Who's covered | Entities meeting the size rules and sector criteria, including roughly the 100 largest water supplies | Companies placed at the relevant levels by Energistyrelsen. For district heating, levels 2 to 4 |
| Supplier rules | A general duty on supply chain security, plus Miljøstyrelsen's guidance from April 2026 | Detailed rules in BEK 260 §§ 29-32 on procedures, contract content, remote access and documentation |
| Incident reporting | Via virk.dk, which routes the report to the authority and the national CSIRT | To Energistyrelsen and the CSIRT through the designated reporting solution |
Water and wastewater: the NIS2 law and Miljøstyrelsen
According to the Ministry of Environment, the cyber rules cover roughly the 100 largest water supplies in Denmark, which deliver about 65% of the country's drinking water. They had to register with Miljøstyrelsen via virk.dk by 1 October 2025. Wastewater companies are covered when they meet the size and sector criteria.
Miljøstyrelsen's guidance on measures for the water sector (vejledning nr. 87, April 2026) is the most practical official text on suppliers for water utilities. It recommends the IEC 62443 series for OT and tells utilities to prioritise suppliers that are critical in a crisis, are a single point of failure or have access to critical assets. It also accepts third-party auditor statements as a useful tool and points to the supplier questionnaires on Sikkerdigital.dk.
Electricity, gas and district heating: BEK 260 and Energistyrelsen
BEK 260 goes further than the directive on suppliers. It requires:
- Procedures for managing suppliers that can affect security of supply or network security (§ 29).
- Specific contract content (§ 30), including security requirements, the supplier's duty to notify you of significant incidents, help with your own reporting, criteria for subcontracting and your continued ownership of data.
- Procedures for supplier remote access to supply-critical systems, written into the supplier agreement (§ 31).
- Documentation, so suppliers can show they meet the requirements (§ 32).
Whether a district heating company is in scope depends on the level Energistyrelsen assigns it, based on the amount of heat it delivers. Companies at levels 2 to 4 are covered by the NIS2 requirements, while level 1 companies have lighter preparedness duties. Check your own level decision rather than relying on general thresholds.
Multi-utilities and smaller waterworks
Many Danish utility groups run water, wastewater and district heating side by side. Each activity follows its own regime, but the same IT provider or SCADA integrator may serve all of them. Keep one supplier register and tag each supplier with the activities and regimes it touches. Then one assessment can serve both supervisors.
Smaller waterworks and cooperatives below the NIS2 thresholds aren't off the hook either. Miljøstyrelsen sent a draft executive order on preparedness for water and wastewater utilities to consultation in September 2026, with planned entry into force on 1 January 2027. The Køge attack hit exactly this kind of small waterworks.
The 8-step NIS2 vendor risk management workflow
The workflow below works under both regimes. Energy utilities should treat BEK 260 as the minimum. Water utilities can use Implementing Regulation 2024/2690 and Miljøstyrelsen's guidance as their benchmark.
Step 1: Set scope and governance
Confirm which regime applies to each activity and write a short supplier security policy. Have the board approve it as part of the risk-management measures it's responsible for, and name an owner for supplier risk. In smaller utilities that's often the IT manager working with the operations manager.
Step 2: Build the supplier register
List every direct supplier and service provider that touches your network and information systems, including OT. For each one, record:
- The services it delivers and the assets and processes they support
- Whether it has remote or physical access, and how
- What data it can see, including personal data
- Its key subcontractors
- Contract, SLA, contact points and the evidence you hold
Link the register to your asset inventory so you can see which critical assets depend on which suppliers.
Step 3: Classify suppliers by criticality
A three-tier model is enough for most utilities. What matters is that the rating changes what you actually do.
| Tier | Typical suppliers in a utility | Due diligence | Review |
|---|---|---|---|
| High | SCADA and PLC integrators with remote access, managed IT and security providers, firewall and VPN vendors, hosting of control or billing systems, telemetry and communications | Questionnaire, evidence review (ISO 27001, ISAE 3402 or SOC 2, IEC 62443), contract review and remote access review | At least annually and after events |
| Medium | Business systems without OT access, maintenance contractors with supervised physical access | Short questionnaire and certificate check | Every one to two years |
| Low | Suppliers with no access to systems or data | Basic check at onboarding | At renewal |
In line with Miljøstyrelsen's guidance, give extra weight to suppliers that are single points of failure or that you'd need during a crisis.
Step 4: Do proportionate due diligence
Send critical suppliers a structured questionnaire and ask for evidence. Sikkerdigital.dk's material on setting security requirements for IT suppliers is a good Danish starting point, and SIG or CAIQ questionnaires work well for cloud services. For OT vendors, ask about IEC 62443-2-4 (security programmes for service providers) or IEC 62443-4-1 (secure product development), their patch and end-of-life policies and, where available, a software bill of materials.
Don't send a 300-question form to a supplier that can't reach anything. Oversized requirement catalogues create work nobody reads. For the audit method itself, see our guide to vendor audits.
Step 5: Put the right clauses in the contract
This is where most utilities have gaps. The checklist below combines the mandatory content in BEK 260 with the contract elements in Implementing Regulation 2024/2690.
☐ Security requirements proportionate to the service, with reference to ISO 27001 or IEC 62443
☐ Notification of incidents without undue delay, with a fixed maximum time for critical suppliers
☐ A duty to help you meet your 24-hour, 72-hour and one-month reporting deadlines, including logs, indicators of compromise and root cause
☐ Notification of vulnerabilities and agreed patch timelines
☐ Remote access rules covering named accounts, MFA, approved and time-limited sessions and logging
☐ Criteria for using subcontractors and a duty to pass requirements down
☐ Audit rights and the right to receive assurance reports
☐ Your ownership of data and its return or deletion at exit
☐ Participation in exercises, plus continuity and repair times
☐ A data processing agreement under GDPR article 28 where personal data is involved
The law doesn't set a number for how fast a supplier must tell you. We recommend a maximum of 4 to 12 hours from the moment the supplier becomes aware, for high-criticality suppliers. That leaves you most of your 24 hours to assess and report. Track the clauses through your contract management process so renewals don't quietly drop them.
Step 6: Monitor and reassess
Review high-criticality suppliers at least once a year, in line with ENISA's guidance. Trigger an extra review when a supplier has an incident, changes owner or misses its SLAs, or when an advisory names a product you rely on. Follow findings until they're closed. A risk assessment matrix keeps ratings consistent between reviewers.
Step 7: Connect suppliers to your incident process
For each critical supplier, the incident runbook should state who at the supplier calls whom, how you record the moment you became aware, who drafts the early warning and how the supplier's findings flow into the 72-hour notification and the final report. Test it once a year with at least one supplier involved.
Step 8: Offboard securely
When a contract ends, revoke remote access and credentials, get your data back or have it deleted, update the register and asset inventory and keep a record of the exit. ENISA lists exit records among the evidence a supervisor may ask for.
OT and remote access: the supplier risk that matters most
BEK 260 § 31 regulates supplier remote access directly, and Miljøstyrelsen points water utilities to IEC 62443. In practice the controls are the same in both sectors.
- No always-on connections. Suppliers connect on request, and someone at the utility approves each session.
- Named accounts with MFA. Shared vendor logins make it impossible to trace who did what.
- Time limits and logging. Sessions close automatically, and logs are kept where the supplier can't change them.
- Patched edge devices. Firewalls and VPN gateways get security updates on a fixed timeline, because that's the route the 2023 attackers used.
- A plan for unsupported equipment. Where a component can no longer be updated, segment it and document the compensating controls.
After the Køge attack, the waterworks' chair told Danish media that the worst part was not being able to reverse the changes themselves. Recovery rights, documentation and exit clauses matter as much as preventive controls.
When the incident starts at your supplier: making 24 hours possible
The guidance from Styrelsen for Samfundssikkerhed on incident notification is clear on outsourcing. If a supplier runs or maintains your systems, notifying the authorities is still your job. You can agree that the supplier submits the notification for you, but you remain responsible for it arriving on time. The clock starts when you become aware of a significant incident, so a slow supplier eats into your deadline.
NIS2 notification deadlines
| Stage | NIS2 law (water and wastewater) | BEK 260 (energy and district heating) | GDPR (personal data) | Recommended supplier deadline |
|---|---|---|---|---|
| First notice | Early warning within 24 hours of becoming aware | Within 24 hours | Notify Datatilsynet within 72 hours (article 33) | Without undue delay, at most 4 to 12 hours |
| Update | Incident notification within 72 hours, with an initial assessment and indicators of compromise | Within 72 hours | Not applicable | Logs, indicators and initial cause before your 72-hour deadline |
| Interim | Intermediate report if the CSIRT asks | Status report if the incident is ongoing | Not applicable | Updates on request |
| Final | Final report no later than one month after the incident notification | Final report within one month | Not applicable | Root-cause report in time for your final report |
| Channel | virk.dk, routed to Miljøstyrelsen and the CSIRT | Energistyrelsen and the CSIRT via the designated solution | Datatilsynet, which can be included on the virk.dk form | Your named incident contacts |
An incident is significant if it has caused, or can cause, severe operational disruption or financial loss for you, or considerable damage to others. The guidance expects you to set your own thresholds, for example for downtime, in your risk assessment. Share those thresholds with critical suppliers so they know what to escalate. Our guide to information security risk management covers how to define them.
Worked example: a supplier incident at a multi-utility
Søby Forsyning A/S and Pumpeteknik Nord ApS are fictional. We made them up for this article.
Søby Forsyning supplies drinking water to 40,000 people and runs a district heating plant at level 2. Pumpeteknik Nord maintains the control systems for both through a single remote access gateway. Søby renewed the contract in 2026 and added a four-hour notification clause.
| Time | What happens | Effect on the deadlines |
|---|---|---|
| Friday 17:10 | Pumpeteknik Nord's monitoring flags logins from an unknown IP address on the remote access gateway | The supplier is aware. The four-hour contract clock starts |
| Friday 19:30 | Pumpeteknik Nord calls Søby Forsyning's on-call manager and shares the logs | Søby records when it became aware. Its 24-hour clock starts |
| Friday 22:00 | Søby isolates the gateway. Pump settings at one waterworks have been changed. The heat plant is untouched | Assessed as significant for water. Heat is logged as not significant |
| Saturday 14:00 | Early warning submitted via virk.dk | Within 24 hours (deadline Saturday 19:30) |
| Monday 18:00 | Incident notification with indicators of compromise from Pumpeteknik Nord | Within 72 hours (deadline Monday 19:30) |
| Within one month | Final report with root cause, based on the supplier's investigation | Meets the one-month deadline |
Two things made this work. The four-hour clause got information to Søby with most of its 24 hours left. And because the shared gateway was in the supplier register, Søby knew to check the heat plant as well. Had the heat plant been affected, Søby would also have had to report to Energistyrelsen under BEK 260. Under the old contract, the supplier only had to notify within five working days, which would have made the deadline impossible.
Documentation the supervisor will ask for
Under the NIS2 law, supervisors can require you to hand over your policies and the information they need to assess your measures. Miljøstyrelsen and Energistyrelsen will look for evidence, not intentions. Keep this information security documentation ready.
| Document | What it shows |
|---|---|
| Board-approved supplier security policy | Management has approved and oversees supply chain measures |
| Supplier register with criticality ratings | You know your suppliers and what they can reach |
| Risk assessments of critical suppliers | Vulnerabilities specific to each supplier have been considered |
| Due diligence records and assurance reports | You checked before and during the relationship |
| Contracts and SLAs with the required clauses | Requirements are binding on the supplier |
| Remote access procedures and logs | Access to critical systems is controlled |
| Review records and remediation actions | Monitoring continues and findings get closed |
| Supplier-related incidents and notifications | Your incident management and reporting works in practice |
| Exit records | Access and data were dealt with when relationships ended |
| Board reporting and training records | Management is informed and trained |
Energy utilities should keep their level decision, risk and vulnerability analysis and preparedness plans with these documents.
Using ISO 27001 and assurance reports as supplier evidence
If you already work with ISO 27001:2022, its supplier controls cover much of article 21(2)(d). The gaps are mostly about deadlines and Danish specifics. For the full requirement-by-requirement comparison, see NIS2 vs ISO 27001.
| ISO 27001:2022 Annex A | Topic | What NIS2 adds for utilities |
|---|---|---|
| 5.19 | Information security in supplier relationships | Board approval and a stated supply chain role |
| 5.20 | Security in supplier agreements | Supplier help with 24-hour, 72-hour and one-month reporting. Data ownership clause under BEK 260 |
| 5.21 | ICT supply chain | Supplier-specific vulnerabilities, secure development and IEC 62443 for OT products |
| 5.22 | Monitoring and review of supplier services | Event-driven reviews after incidents and advisories |
| 5.23 | Cloud services | Cloud providers bound by 2024/2690 should share their evidence |
| 5.24 to 5.26 | Incident management | An external 24-hour deadline, which ISO 27001 doesn't set |
| 8.8 | Technical vulnerabilities | Supplier patch timelines and end-of-life OT |
Assurance reports are useful evidence, but they don't replace your own assessment. Before you accept an ISAE 3402, ISAE 3000 or SOC 2 report, check that:
- It covers the services and locations you actually use
- It's a type 2 report and the period is recent
- You know which complementary controls you're expected to run yourself
- No exceptions noted by the auditor affect you
Many OT vendors have none of these reports. Then an IEC 62443 certificate, a targeted questionnaire or an on-site audit has to do the job.
The GDPR overlap: one assessment, two clocks
Many critical IT suppliers, such as billing, customer portal and hosting providers, also process personal data for you. Assess them once against both NIS2 and GDPR article 28, and keep the data processing agreement in the same contract package. When an incident affects personal data, the GDPR 72-hour deadline for notifying Datatilsynet runs alongside the NIS2 deadlines, and the virk.dk form lets you include Datatilsynet in the same submission. Our guide to auditing data processors covers the GDPR side.
Choosing NIS2 compliance and risk management software for vendor management
A spreadsheet can carry a small waterworks with ten suppliers for a while. It struggles once you need to connect suppliers to assets, risks, contracts and incidents and show a supervisor the history. When you compare NIS2 compliance platforms, look for these capabilities.
| Capability | Why it matters for a utility |
|---|---|
| Supplier register linked to assets and processes | You can see which critical systems depend on which supplier |
| Criticality ratings and questionnaires | Due diligence scales with risk instead of one form for everyone |
| Evidence storage with expiry dates | You know when an ISO certificate or ISAE report runs out |
| Contract obligations and renewal tracking | Notification and remote access clauses survive renegotiation |
| Risk assessment with treatment plans | Supplier risks sit in the same register as your other risks |
| Incident documentation | You can show what happened, when you knew and when you reported |
| Frameworks for both NIS2 and ISO 27001 | One piece of work answers several requirements |
| Board reporting | Management can oversee supply chain risk, as article 20 requires |
Software won't make you compliant on its own. It makes the work repeatable and the evidence easy to find. Ideally, supplier risk also feeds your wider enterprise risk management, so the board sees one picture instead of separate lists.
How .legal supports NIS2 vendor risk management
.legal is a Danish GRC platform used by more than 400 organisations. The vendor management module holds your supplier register, assessments and evidence. The information security module covers assets, controls and the NIS2 framework alongside ISO 27001. Risk management keeps supplier risks next to your other risks, and contract management tracks the clauses you've agreed. Because the modules share data, one supplier assessment can serve NIS2, ISO 27001 and GDPR at the same time.
Want to see how it works for a utility? Book a demo.
Have more questions?
Ask Johannes directly, he runs most of our demos personally. Book him here.
Related reading on NIS2 and suppliers
.legal compliance platform
Keep every supplier, contract and incident in one place
Build the supplier register once and link it to your assets, risks and contracts. .legal tracks due diligence, evidence and notification clauses, so you can show Miljøstyrelsen or Energistyrelsen what you did and when.
-
Supplier register linked to assets, processes and OT access
-
Criticality ratings, questionnaires and evidence with expiry dates
-
Contract clauses and renewals tracked, including notification times
-
Incident log ready for the 24-hour, 72-hour and one-month reports
-
NIS2 and ISO 27001 frameworks from the same assessment
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
