The toolbox outlines risk scenarios affecting ICT supply chains and recommends mitigation measures, including assessment of critical suppliers, multi-vendor strategies, and approaches to reduce dependency on high-risk suppliers. It was developed by the NIS2 Cooperation Group, involving Member States, the European Commission, and ENISA, which will review its implementation progress after one year. The release is accompanied by two dedicated risk assessments covering connected and automated vehicles, and detection equipment used at borders and customs.
Author: NIS2 Cooperation Group (European Commission, Member States, ENISA)
Status: Adopted / Published
Adoption date: 2026-02-13
Last updated: 19 Aug 2026
Category: Guidance
Subcategory: Official recommendations