Practice shows from the outside

Article 21 of the NIS2 Directive lists supply-chain security as a measure in its own right, transposed in Germany in Section 30(2) no. 4 of the BSI Act. Paragraph 3 of the Directive says what this measure should be guided by: entities shall take into account "the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers".

Cybersecurity practices. Not cybersecurity concept, not certificate, not promise.

The questionnaire measures something else

In most organisations the tool for this is the supplier questionnaire. It makes sense and remains necessary, because only it captures what cannot be seen from outside: roles, processes, contingency plans, subcontractors. But it is a self-declaration. It says what a supplier knows or believes it knows about itself, at the time of filling it in, and often sales answers it.

Part of the practice, on the other hand, is publicly visible. Whether the supplier's mail domain has an enforced DMARC policy. Whether a certificate expired three weeks ago. Whether a remote maintenance service is directly reachable from the internet. Whether credentials with its domain appear in known data leaks. Nobody has to tick a box for that, and anyone can look it up, including someone who wants to attack the supplier.

What an external rating proves and what it does not

An external view only measures the surface. A good grade does not prove that everything is right inside. A bad one, however, reliably shows that corners are being cut on something basic, and on exactly the things a questionnaire usually answers with yes. That comparison is the value: the external view does not replace the questionnaire, it checks it.

There is a second view no questionnaire provides: shared dependencies. If five critical suppliers sit with the same mail or hosting provider, that is a risk that appears in no single assessment, only in the sum.

How isidaten handles it

The supplier external view assesses a supplier's domains with the building blocks of attack surface analysis and combines them into an external rating from A to F. It is built from six weighted sub-ratings: attack surface, e-mail, DNS, dark web and data leaks, DDoS resilience, and web and privacy. An open critical finding or a subdomain that can be taken over caps the grade at D at most, so it does not disappear in the average. If a supplier has several domains, the worst value counts for each individual measurement.

Without consent, only queries run that any third party could make: DNS, certificate transparency logs, public leak sources, one page request per host. Port scans and other active checks require the supplier's documented consent. Name guessing and vulnerability scans never run against a supplier, not even with consent.

Release rules check every assessment against your own organisation's requirements and return green, yellow, red or unknown. Unknown means a rule lacks the data it needs. Not measured is never clean; a rule without data never makes the result green. The cumulative view shows shared dependencies across all suppliers, and a quick assessment checks a domain before the supplier has even been created.

And the supplier can learn about it. If notification is switched on for that supplier and its grade has worsened, it receives the three largest deductions with a hint on what to do, at most once a week. No details on data leaks, addresses or host names leave in the process. A check over the supplier's head thus becomes an occasion to change something together.

The test question

Which of your ten most important suppliers have a mail domain without an enforced DMARC policy?

If you could only learn that from the questionnaire, you have not learned it yet.

Sources

Directive (EU) 2022/2555 (NIS2), Article 21(2)(d) and (3). Section 30 BSIG, subsection 2 no. 4 (German).