Basics
NIS2 for suppliers: what customers in Germany and Austria now expect from SMEs in Switzerland and Liechtenstein
By Dominik Natter · Last updated on 5 November 2026 · 12 min read
In short
As a rule, Swiss SMEs are not directly covered by NIS2, but they feel it through their customers: in-scope companies in Germany and Austria must manage the security of their supply chain and therefore ask suppliers for questionnaires, evidence and new contract clauses. In Liechtenstein, NIS2 has applied directly since 1 February 2025 to medium-sized and large companies in the covered sectors. ISO 27001 certification is not mandatory for suppliers. What matters is that you can show your security measures in a verifiable way.
Does NIS2 apply to companies in Switzerland and Liechtenstein?
For most Swiss SMEs it does not, at least not directly. NIS2 is an EU directive. It applies through national laws to companies that are established in the EU or the EEA and operate in certain sectors. In Germany and Austria, this generally means companies of medium size and above: 50 or more employees, or more than EUR 10 million in both annual turnover and balance sheet total.
Liechtenstein is different. As an EEA member, it transposed NIS2 with the fully revised Cyber Security Act (CSG), which has applied since 1 February 2025. It covers medium-sized and large companies under Liechtenstein company law that operate in a sector listed in its annexes. Besides energy, transport and health, these include mechanical engineering, the manufacture of electronic products, electrical equipment and vehicle parts, food, chemicals and providers of managed IT services for businesses.
The bigger effect, however, comes through customers. Anyone supplying an in-scope company in Germany, Austria or Liechtenstein receives questionnaires, new contract clauses and audit requests, even as a small business in Switzerland.
- NIS2 has applied in Germany through the new BSI Act since this date
- 6 December 2025
- Austria's NISG 2026 in force, registration by 31 December 2026
- 1 October 2026
- Liechtenstein's fully revised Cyber Security Act in force
- 1 February 2025
- Deadline for the early warning of significant incidents in DE, AT and FL
- 24 hours
NIS2 supply chain: why you get questionnaires although the law does not name you
NIS2 requires in-scope companies to take risk management measures. One of them is explicitly supply chain security, including relationships with direct suppliers and service providers. This is set out in section 30 of the German BSI Act and article 4 of Liechtenstein's CSG. Austria's NISG 2026 requires it too. Companies must take into account the vulnerabilities and security practices of each individual supplier.
Germany's Federal Office for Information Security (BSI) makes clear that the law does not automatically oblige every supplier. The obligation lies with the customer. The customer must, however, contractually bind its suppliers to appropriate security requirements. The BSI recommends agreements on risk management, incident handling and patch management. If a supplier does not meet the requirements, the BSI says it is a business decision for the customer whether to keep working with it.
The Austrian Economic Chamber (WKO) takes a similar view: not all suppliers are covered, mainly those that support network and information systems used for the customer's services. A general reference to the law in purchasing terms is not enough. The customer must set specific requirements depending on the risk.
For you, this means the pressure comes from your customer, not from an authority. And it grows the closer your service is to the customer's IT.
NIS2 in Switzerland, Liechtenstein, Germany and Austria: what applies where?
| Country | Law | In force since | Who is covered | What it means for suppliers |
|---|---|---|---|---|
| Germany | BSI Act, revised by the NIS2 Implementation Act | 6 December 2025 | Companies in the sectors of annexes 1 and 2, generally with 50 or more employees or more than EUR 10 million in turnover and balance sheet total. Registration with the BSI within three months, the first deadline has passed. | Customers contractually bind suppliers to security requirements. Questionnaires and audits are common. |
| Austria | NISG 2026 | 1 October 2026 | Essential and important entities of medium size and above in the covered sectors. Registration by 31 December 2026, self-declaration by 30 September 2027. | Contractual requirements depending on the risk. A general reference in purchasing terms is not enough for the customer. |
| Liechtenstein | Cyber Security Act (CSG), fully revised | 1 February 2025 | Medium-sized and large companies in the sectors of annexes 1 and 2, some providers regardless of size. | Directly covered if you meet the criteria yourself. Otherwise as in Germany: requirements come through customers. |
| Switzerland | Information Security Act (ISA), reporting obligation for cyberattacks | 1 April 2025 | Operators of critical infrastructure and manufacturers of hardware or software with remote maintenance access used by them. NIS2 does not apply. | Report to the Federal Office for Cybersecurity within 24 hours if you are subject to the obligation. Otherwise requirements come through customers. |
| EU market, products | Cyber Resilience Act | Reporting obligations since 11 September 2026 | Manufacturers of software and connected devices sold in the EU, regardless of where they are based. | Applies directly to your product, not through the customer. |
Key dates at a glance
1 February 2025
Liechtenstein: CSG in force
Existing entities had to register with the Cyber Security Unit within four weeks.
1 April 2025
Switzerland: reporting obligation for cyberattacks
Since 1 October 2025, violations can be fined up to CHF 100,000.
6 December 2025
Germany: new BSI Act
Registration with the BSI within three months. According to the BSI, the statutory deadline has passed and late registrants should register immediately.
11 September 2026
EU: Cyber Resilience Act reporting obligations
Manufacturers report actively exploited vulnerabilities and severe incidents affecting their products.
1 October 2026
Austria: NISG 2026 in force
Until then, the NISG 2018 applied.
31 December 2026
Austria: registration closes
Essential and important entities register through the Austrian business service portal.
30 September 2027
Austria: self-declaration
In-scope entities submit their self-declaration on the measures implemented.
11 December 2027
EU: Cyber Resilience Act fully applies
From then on, all requirements for products with digital elements apply.
What do customers actually ask NIS2 suppliers?
Questionnaires look different, but the topics hardly vary. They follow the minimum measures in the law, such as section 30 of the BSI Act or article 4 of the CSG. Expect these questions:
- Multi-factor authentication: is it enabled for email, remote access, admin accounts and access to customer systems?
- Backups and recovery: are there backups outside the main system, and has recovery been tested?
- Patch management: how quickly do you install security updates, and who is responsible?
- Access rights: who can access customer data and customer systems, and how do you revoke rights when someone leaves?
- Encryption: is data encrypted in transit and on laptops and servers?
- Incident reporting: within what time do you inform the customer of a security incident that could affect them?
- Contact person: who is responsible for information security and reachable in an emergency?
- Subcontractors: which service providers, hosting and cloud services do you use, and where is the data stored?
- Software bill of materials and updates: which components does your software contain, and for how long do you provide security updates? This is where NIS2 overlaps with the Cyber Resilience Act, see the guide «Cyber Resilience Act: what applies to software from SMEs in Switzerland and Liechtenstein?».
- Training: are employees regularly trained on phishing and secure passwords?
Do you need ISO 27001 as a supplier?
No, the law does not require it. Neither NIS2 nor its transposition in Germany, Austria or Liechtenstein requires suppliers to hold a specific certificate. The WKO states that there is no general certificate proving compliance with the NISG 2026. Besides certifications, it lists ratings, audits and individual evidence, such as the Cyber Risk Rating of the Austrian security association KSÖ. According to the WKO, even ISO 27001 certification only proves organisational and operational implementation, not technical implementation. And it only helps if its scope covers the service you provide to the customer.
Your customer may, however, require a certificate by contract. For a business with only a few employees, certification is in our view often disproportionate. Setting it up, external audits and annual surveillance take time and money that usually achieve more when spent on concrete measures. Ask whether a completed questionnaire with evidence is enough. This is often negotiable if you can show concrete evidence.
Questionnaire with evidence or certificate?
A questionnaire with evidence is usually enough if
- You have no permanent access to the customer's systems.
- You have few NIS2 customers, each sending their own questionnaire.
- You supply parts or a clearly defined piece of software and do not operate the customer's IT.
- You can back up your measures with policies, screenshots and test records.
Certification is more likely to pay off if
- Several large customers explicitly make it a condition.
- You operate or remotely maintain customer systems.
- You want to win tenders where ISO 27001 is a criterion.
- You are building an information security management system anyway.
How to answer a NIS2 supplier questionnaire efficiently
A long questionnaire can be daunting. With a fixed process, you answer it thoroughly once and reuse the answers for your next customers.
01
Build an inventory
List systems, data, access to customer systems and the service providers you use. Without this overview, many answers remain guesswork.
02
Mark gaps honestly
Answer each question with met, partly met or open. A «partly» with a plan is more convincing than a «yes» you cannot prove in an audit.
03
Action plan with dates
For each open measure, decide who implements it and by when. Start with the biggest risk, usually multi-factor authentication, backups and updates.
04
Collect evidence
File your evidence: policies, screenshots of settings, records of recovery tests and the list of subcontractors. The next questionnaire then goes much faster.
05
Review contract clauses
Check reporting deadlines, audit rights, liability and flow-down to subcontractors before you sign. Negotiate what you cannot comply with.
06
Update every year
Keep answers and evidence up to date. Many customers ask again periodically, and your systems change.
What software suppliers should actually deliver
If you deliver custom software or run an application for a NIS2 customer, you are part of its supply chain in the narrowest sense. The BSI Act explicitly mentions security in the acquisition, development and maintenance of systems, including vulnerability handling. You should be able to show your customer the following:
- Security updates: fixed deadlines for critical vulnerabilities in your own software and in the libraries and frameworks it uses.
- List of components: which libraries, frameworks and services the software contains, ideally as a software bill of materials (SBOM).
- Logging: logins, permission changes and critical actions are logged and kept long enough to investigate an incident.
- Access control: multi-factor authentication for administrators, roles with minimal permissions and no shared accounts.
- Backup and recovery: documented backups and a tested procedure that gets the application running again within the agreed time.
- Incident response plan: who does what in an incident, who informs the customer and how access is blocked.
- Hosting and subcontractors: where the data is stored and which service providers have access.
Much of this belongs in a good maintenance contract anyway. As a guideline, we budget around 15% of the project cost per year for maintenance and operations. Details in the guide «Software maintenance costs: what do maintenance and operations cost per year?».
If an existing application lacks multi-factor authentication or logging, retrofitting it is often a manageable package. Example calculation, not a fixed price: 30 to 60 hours at CHF 70 come to CHF 2,100 to 4,200. The actual effort depends on the technology and condition of the application.
What this means for your role
You develop or supply software for a NIS2 customer. Expect questions on secure development, updates, vulnerabilities and remote access.
If you sell the software in the EU, the Cyber Resilience Act also applies to you directly.
You operate, maintain or monitor your customers' systems. You are closest to their IT and face the strictest requirements.
From medium size upwards, check whether you are covered yourself as a managed service provider under NIS2 or Liechtenstein's CSG.
You supply parts or goods without access to the customer's IT. Questions are usually shorter and focus on email security, ordering channels and interfaces.
If you supply connected components, questions about software and updates are added.
First check whether you are covered by the CSG yourself: a medium-sized or large company operating in a sector listed in the annexes, such as mechanical engineering, electronics, food or IT services for businesses. If so, registration, risk management and reporting obligations apply directly.
The Cyber Security Unit provides a decision chart on the scope of the law.
NIS2 does not apply to you directly as long as you have no establishment in the EU and offer no managed IT or cloud services in the EU.
Do check the reporting obligation under the Information Security Act, however, if you supply operators of critical infrastructure, such as energy utilities, hospitals or transport companies, and maintain your software there remotely.
What you should do now
Do not wait for the first questionnaire. These steps are worth taking today:
- Review customers: which customers in Germany, Austria and Liechtenstein could be covered by NIS2? Sector and size are enough for a first list.
- Check your own scope: an establishment in the EU, managed IT services, a registered office in Liechtenstein or software for critical infrastructure in Switzerland?
- Put the basics in place: multi-factor authentication, tested backups and regular updates cover a large share of the questions.
- Prepare answers: a standard document describing your security measures saves time with every questionnaire.
- Define a reporting process: who reports what, to whom and how quickly? Including contact details and a deputy.
- Review contracts: read new clauses on reporting deadlines, audit rights and liability before signing, and negotiate where needed.
- Ask your own providers: what your customers require from you, you should also require from your hosting and software providers.
Sources and notes
Germany
BSI Act of 2 December 2025 (Federal Law Gazette 2025 I No. 301), promulgated on 5 December 2025, in particular section 28 on thresholds, section 30 on risk management and supply chain, section 32 on reporting deadlines, section 33 on registration and section 60 on providers without an establishment in the EU. Also the BSI's information on registration and its information package on supply chain security. The entry into force on 6 December 2025 is taken from announcements by the German chambers of commerce (IHK).
Austria
Network and Information Systems Security Act 2026 (NISG 2026), Federal Law Gazette I No. 94/2025, published on 23 December 2025. Entry into force, registration, self-declaration, suppliers and evidence according to the Austrian Economic Chamber (WKO), its FAQ on the NISG 2026 and its page on supply chain security. The size threshold follows the European Commission's SME recommendation 2003/361/EC.
Liechtenstein
Cyber Security Act (CSG) of 5 December 2024, Liechtenstein Law Gazette 2025 No. 111, in force since 1 February 2025, in particular article 1 on scope, article 4 on risk management and supply chain, article 6 on reporting obligations, articles 7 and 26 on registration and annexes 1 and 2. Also the Cyber Security Ordinance (CSV), Law Gazette 2025 No. 163, the government's report and motion No. 93/2024 and the Cyber Security Unit's decision chart on scope.
Some commercial sources mention deadlines for organisational measures by February 2026 and technical measures by February 2027. We did not find these deadlines in the act or the ordinance. The obligations have applied since entry into force.
Switzerland and EU
Information Security Act (ISA, SR 128), article 74b, as at 1 April 2025, and the Cybersecurity Ordinance (SR 128.51) with the exemptions from the reporting obligation. Also the Federal Office for Cybersecurity's information on the reporting obligation and the fines from 1 October 2025. For the Cyber Resilience Act, Regulation (EU) 2024/2847.
Not legal advice
This guide is not legal or tax advice. Whether your company or your customer is covered by NIS2, the CSG or the Swiss reporting obligation must be assessed case by case with an expert or the competent authority. The BSI's scope check and the Cyber Security Unit's decision chart are a good first orientation.
As at: November 2026.
Frequently asked questions
Does NIS2 apply to Swiss companies?
Not directly, as a rule. NIS2 is an EU directive and applies through national laws to companies in the EU and the EEA. Indirectly, it affects many Swiss SMEs: customers in Germany and Austria have to manage the security of their supply chain and pass requirements on through contracts and questionnaires. Swiss companies can be directly affected if they have an establishment in the EU or offer cloud or managed IT services in the EU.
Does NIS2 apply in Liechtenstein?
Yes. Liechtenstein transposed NIS2 with the fully revised Cyber Security Act (CSG), in force since 1 February 2025. It mainly covers medium-sized and large companies in the sectors listed in its annexes, such as energy, health, mechanical engineering, electronics, food or IT services for businesses. They must register with the Cyber Security Unit, implement risk management measures and send an early warning of significant security incidents within 24 hours.
Do we need ISO 27001 as a supplier?
Not by law. Neither NIS2 nor its transposition in Germany, Austria or Liechtenstein requires suppliers to hold a specific certificate, although your customer can require evidence by contract. For small suppliers, a well-answered questionnaire, documented measures and an incident response plan are often enough. In our view, certification pays off mainly when several large customers explicitly demand it or when you operate systems for customers.
What is the difference between NIS2 and the Cyber Resilience Act?
NIS2 regulates organisations, the Cyber Resilience Act regulates products. NIS2 requires entities in key sectors to manage cyber risks, secure their supply chain and report security incidents. The CRA requires manufacturers of software and connected devices sold in the EU to develop securely, provide security updates and report actively exploited vulnerabilities. As a software supplier you may feel both: NIS2 through your customers and the CRA directly.
Do Swiss companies have to comply with the Cyber Resilience Act?
Yes, as soon as they offer software or connected devices in the EU. The CRA applies to the EU market, regardless of where the manufacturer is based. It does not apply within Switzerland itself. However, the Federal Council has commissioned a Swiss cybersecurity act modelled on the CRA, with a consultation draft planned by June 2027.
Who runs the software after go-live?
We do, if you wish. A maintenance contract covers hosting in the EEA, monitoring, security updates, backups and agreed response times. The usual figure is 15 to 20% of the project cost per year. You can also run the software on your own infrastructure or hand it to your IT partner.
Matching services:Custom softwareIntegrations
Let us talk about your case.
20 minutes are enough to find out whether a custom solution is worth it for you.