Open training, B5
Supply chain security and requirements for suppliers
A workshop for those accountable for suppliers rather than for systems. You leave with your own supplier categorisation and a set of clauses that can be enforced.
Duration: 1 day, 9:00 to 16:00
About the course
NIS2 makes the supplier's security the customer's problem. This means that an incident at a subcontractor becomes your incident, and the supervisory authority asks not about their security controls but about how you selected them, what you asked them and what you put in the contract.
Most organisations respond to this with a security questionnaire of several dozen questions, which the supplier fills in once and to which nobody ever returns. This workshop goes the other way: first the categorisation of suppliers by real criticality, then a short questionnaire matched to the category, and finally contractual clauses and monitoring during the term of the contract.
Participants build a questionnaire for three categories of suppliers using their own examples.
Hourly programme
- 9:00What NIS2 and the KSC Act require in relation to suppliers. The limits of accountability
- 10:00Categorising suppliers. Which of them are critical and how to tell
- 11:00Break
- 11:15A security questionnaire that makes sense. What to ask about and what not to ask about
- 12:15Workshop: we build a questionnaire for three categories of suppliers
- 13:00Lunch break
- 13:45Contractual clauses. What to put in the contract and how to enforce it afterwards
- 14:45Monitoring the supplier and responding to an incident on their side
- 15:30Questions
Who it is for
Procurement, contract lawyers, security coordinators, IT.
Outcome
Participants leave with a categorisation of their own suppliers, an assessment questionnaire matched to the category, and a set of contractual clauses ready to be handed to a lawyer.
Materials
Supplier assessment questionnaire, catalogue of contractual clauses, criticality matrix, certificate.
Format and group size
Live online or on site, group of 6 to 15 people.
Prerequisites
None.
The catalogue of contractual clauses is training material and does not constitute legal advice. Before being used in contracts it requires review by the lawyer advising your organisation.
Dates
B5
Registration openSupply chain security and requirements for suppliers
22 October 2026, Thursday9:00 to 16:00, 1 day, 9:00 to 16:00Online1 290 PLN net for registrations up to 30 September 2026
1 490 PLN net after that date
per person
Registration until 16 October 2026
Both days in the "Bundle: 21 and 22 October" bundle. You can choose the bundle in the registration form.
2 190 PLN net for registrations up to 30 September 2026
2 490 PLN net after that date
Training sessions are not recorded.
Prices are net amounts, to which VAT at 23% is added. Buyers financing the training at least 70% from public funds are asked to notify us before the invoice is issued.