CloudSignLab
Sign inStart free

Help centerRegisters and records

Manage your supplier register

Record your suppliers, how critical they are, whether they can reach your data and when their security is checked, as NIS2 asks.

Updated September 29, 2026

In this section: Registers and records

NIS2 asks you to manage the security of your supply chain. The supplier register lists the companies you depend on, how critical they are and when you last checked their security.

How to add a supplier

  1. Open Suppliers in the menu, then Add supplier.
  2. Enter the Supplier name and What they provide, and choose the Type, for example Cloud provider, IT service or Software vendor.
  3. Choose the Criticality (Low to Critical), the Status (Onboarding, Active or Offboarded) and who it is Managed by.
  4. Tick Has access to our data if they can reach personal or confidential data, or your systems.
  5. Add the Country, Contact person, Contact email and Website if useful.
  6. Enter the Contract ends date, the Last security check and the Next security check, and any Notes.
  7. Click Save supplier. It gets a number such as S-5.

How to work with the register

  • Suppliers that can reach your data are marked Has access to data in the list.
  • Search, filter by type, criticality or status, and sort by reference, most critical first, name or next assessment.
  • The page shows how many security checks are overdue.
  • When you stop working with a supplier, set its status to Offboarded instead of deleting it.

Reminders

  • Suppliers with a Next security check date appear in Tasks as Supplier security check. When the date has passed, the person in Managed by gets one reminder (or the owners and admins if nobody is set).
  • 60 days before Contract ends, the same person gets a reminder, so there is time to renew or change supplier.
  • Offboarded suppliers are left alone.

Tips

  • Start with the suppliers that run your IT, host your data or could stop your services.
  • Members can see the register and add suppliers. Changing and deleting them needs an owner or admin (or a custom role with that permission).
  • Every change is shown under History. Contact details are not copied into the history.
  • Package limits: Free 10 suppliers, Supplier 25, Professional and higher unlimited.

Export and Import move the list to and from a spreadsheet. For financial entities, the DORA register of information section of the form holds the LEI, the type of ICT service and whether it supports a critical function, and DORA register (CSV) downloads the register.

See also