Are your software suppliers a risk to your NIS2 compliance?
Since October 2024, NIS2 requires you to control your software supply chain security. A vulnerable dependency in a supplier is your responsibility.
LibTracker inventories your dependencies, detects CVEs, and generates the SBOMs that NIS2 demands.
NIS2 Directive Timeline
December 14, 2022
NIS2 Adoption
Publication in the EU Official Journal (2022/2555)
January 16, 2023
Entry into Force
The directive officially enters into force
October 17, 2024
National Transposition
Deadline for transposition into Member States' law
2025 and beyond
Enforcement and Sanctions
Progressive enforcement by national authorities
Who is affected by NIS2?
18 essential and important sectors
Essential entities
- Energy (electricity, oil, gas, hydrogen)
- Transport (air, rail, maritime, road)
- Banking and financial market infrastructures
- Health (hospitals, laboratories, medical device manufacturers)
- Drinking water and wastewater
- Digital infrastructure (DNS, cloud, data centers)
- Public administration
- Space
Important entities
- Postal and courier services
- Waste management
- Chemical industry
- Food industry
- Manufacturing (medical devices, electronics, machinery)
- Digital services (marketplaces, search engines, social networks)
- Research
NIS2 Requirements for Software Supply Chain
What the directive mandates
Component Inventory
Know and document third-party software components
- Complete mapping of direct and transitive dependencies
- Documentation of versions in use
- Traceability of component origins
Vulnerability Management
Detect and fix security flaws
- Continuous monitoring of known vulnerabilities (CVE)
- Fast remediation process for critical flaws
- Documentation of measures taken
Supplier Security
Evaluate and monitor your providers
- Due diligence on critical suppliers
- Contractual security requirements
- Regular review of security practices
Incident Reporting
Notify authorities in case of incident
- Early warning within 24 hours
- Full notification within 72 hours
- Final report within one month of the incident
How LibTracker Helps You with NIS2
What LibTracker covers for your NIS2 compliance
What LibTracker covers
- Automatic inventory of all your dependencies (SBOM)
- Real-time CVE monitoring with alerts
- Audit history for your certifications
- SBOM export in standard formats (SPDX, CycloneDX)
- Documentation of your software supply chain
What LibTracker does not cover
NIS2 is an organizational directive. LibTracker is a technical tool that does not replace:
- Overall governance and risk analysis
- Organizational incident management
- Business continuity and recovery plans
- Staff training and awareness
- Non-software supplier audits
What you risk for non-compliance
€10M
or 2% of global revenue
Suspension
of activity by authorities
Executives
personally liable