Supplier assurance under NIS2
The clean answer when the auditor asks.
Vittnor — Supply Chain Assurance for the mid-market. One record per supplier: what's in scope, its risk tier, the evidence and a decision for every period. When the auditor asks, you open it.
- Designed for NIS2 Article 21(2)(d)
- Stored in the EU (Microsoft Azure, Sweden Central)
- In English and Slovak
Most NIS2 obligations have a playbook. Supply chain security doesn't.
Walk through the NIS2 obligations as a CISO or Head of IT. Awareness training has a playbook. Incident response has a runbook. Patch management is procedural. Supply chain security isn't. The evidence sits with external parties. It arrives in a dozen formats. It expires unevenly. And someone has to defend the decisions later. That's why Vittnor is its own product: the obligation deserves its own tool.
Two questions. Could a colleague reconstruct your last supplier decision, what was approved and why, without asking you? If a supplier disclosed a breach this morning, is "what do they do for us, and what did we check?" a lookup or a project? Good answers to both: keep the spreadsheet. A wince at either: keep reading.
When a supplier discloses an incident.
The difference is what you had in place the day before.
The usual workflow
You open the supplier register spreadsheet. You search SharePoint for their last assessment, your inbox for the contract, a different folder for the evidence files, your calendar for the last review date. Half a day per supplier. Longer if the original reviewer has left. By the time you've reconstructed who reviewed what and when, you're not sure you have the latest version of anything.
The Vittnor workflow
You open the supplier. What it provides you, and what's in scope. A tier for each of six categories; the overall tier is the worst of them. Each requirement with its answer and evidence, approved or rejected. The decision for this period, with who recorded it and when. The CEO gets the answer the same morning. When the auditor asks months later, you open the same record, sealed once its period is over.
Four steps, one record per supplier.
Scope: know which suppliers count.
Add each supplier and say what it does for you: 15 supplier types, 75 typical services, or add services of your own. Five questions decide whether each is in scope, among them "Which of your data can this service see or hold?" and "Does it have access to your environment?"
On file: a verdict on every type or service, In scope or Out, computed from your answers.
Assess: a risk tier set by the weakest category.
Twelve questions give each in-scope type or service a tier for six categories: availability, confidentiality, privileged access, supply chain, jurisdiction and resilience. The supplier's tier is the worst category, not an average, so five good categories don't average a weak one away.
On file for the board: one tier per supplier and the six behind it. No score to argue over.
Evidence: answer from your own records first.
Build the questionnaire from 35 ready-made requirements, or your own, and answer each from what you already hold: contracts, certificates, documents on file, public information. Where the supplier has joined Vittnor, ask it only for what's missing; it answers there, and every rejection carries a reason.
On file: every requirement, its answer and evidence, approved or rejected, versions kept.
Decide: one decision per supplier, per period.
Record the decision: Approve, Approve with risk or Reject, with a rationale for the last two. It freezes a snapshot of what you decided on; when the next period starts on its own, the review is sealed. Vittnor records who did what, and when.
On file for the auditor: the decision, who recorded it and when, and the snapshot behind it, still there when they ask eighteen months later.
Who it's for
Head of IT or CISO
Ten responsibilities, and this one gets a record. When a supplier is in the news, you're the one who gets asked. You open that supplier and answer from its record, not from your inbox. The next review starts on its own, with an in-app reminder before the period ends.
GRC or compliance lead
Defensibility, not framework gymnastics. "How did you decide this?" gets a record, not a recollection: a decision per period with a name and a date, sealed when the next period begins. Article 21(2)(d) is the obligation it's built around.
Owner or CEO
Written down, with a name on it. Fines are high. Planning and an easy process are cheaper. You don't need the acronyms; you need to know the suppliers that could hurt the business have been looked at, that someone decided in writing with a date, and that you can show it when asked.
A customer assesses you in Vittnor?
Answering is free of charge. Once your company is set up on Vittnor, your customer's requests arrive there, grouped by customer with due dates, not in your email. Up to 10 people from your company can help answer on the Free plan.
What you do. Answer each item Yes, No, Partial or N/A, or decline with a reason, and attach a file or a link. If your customer asks for changes, you see why and resubmit. Each customer sees only what you send to them.
Why you're asked. Under NIS2 Article 21(2)(d), regulated companies must manage security in their relationships with their direct suppliers or service providers. If your customer is one, the obligation is theirs; using Vittnor is not itself a legal requirement for you.
Why trust it
Stored in the EU (Microsoft Azure, Sweden Central)
Database, files and backups are stored in Sweden Central. Cloudflare's network sits in front of Vittnor.
Designed for NIS2 Article 21(2)(d)
Article 21(2)(d) names "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" among the measures essential and important entities must take. Vittnor is built around that measure.
Microsoft Partner
Vittnor runs on Microsoft Azure. Your people sign in with Microsoft, and Vittnor keeps no passwords of its own. Shards Cybersecurity, the company behind Vittnor, is a Microsoft Partner.
Evidence handled with care
PDF, Word or image files up to 25 MB. A SHA-256 fingerprint is recorded at upload, and downloads go through links that expire.
Shaped by security practitioners
Vittnor's design comes from over a decade of security work in regulated industries, including supplier selection, vendor management and audit-evidence preparation, and was tested with practising security and risk professionals from the segment Vittnor serves.
Free opens soon, paid plans follow
Free: 5 suppliers you review, one person working on them, up to 10 people answering your customers' requests; it opens soon on Microsoft Marketplace. Starter (up to 25 suppliers, five people) and Growth (up to 75, fifteen people) are in preparation. The pilot is the way in today. See plans and pricing →
Questions buyers ask
Do my suppliers have to pay or join, and what if one won't?
No payment: answering is free of charge for them. If a supplier isn't on Vittnor, or won't use it, you still complete the review from your own records, or ask us to find the company; we set it up in Vittnor and invite its first person. Verified means we checked its identity, not its security.
Where is our data?
Stored in the EU (Microsoft Azure, Sweden Central), backups included. Traffic passes through Cloudflare's network, which can handle it outside the EU. Sign-in is with Microsoft; Vittnor keeps no passwords of its own.
What does the pilot cost, and what does it commit me to?
You sign a pilot agreement and join free or at compute cost, as it sets out. You run your real suppliers in Vittnor and tell us what's missing. When the Microsoft Marketplace listing opens for purchase, you move to a plan.
Can we use it in Slovak?
Yes. The app is in English and Slovak, and each person chooses their own language. The supplier types, services and requirements are written in both.
Does Vittnor replace our audit?
No. Vittnor keeps the structured, attributable record an audit draws on; the audit still happens with your auditor. What changes is how much of the preparation is already in place when they arrive.
Pilot open today.
Bring your real suppliers. You run them in Vittnor from the first review and tell us what's missing: we help you, you help us. Nothing to install.