Supply Chain Security: From Compliance Burden to Competitive Edge

9 Min. Read Time

In March 2024, a Microsoft engineer stumbled upon a backdoor in XZ Utils – a library embedded in virtually every Linux distribution. The attacker had spent two and a half years building trust, became a co-maintainer, and then inserted a backdoor that would have enabled remote code execution via SSH. The discovery was a matter of luck, not skill. As of December 2025, NIS2 is in effect in Germany, making supply chain security a documented board responsibility. What was once voluntary is now law.

Key Takeaways

• NIS2 Effective Immediately: The German implementation law (NIS2UmsuCG) has been in effect since December 2025, affecting around 29,000 companies – six times more than under NIS1
• Damage Assessment: 266.6 billion Euro total damage caused by attacks on German companies in 2024, with 178.6 billion attributed to cybercrime (Bitkom)
• Supply Chain Risk: 75 percent of organizations experienced a software supply chain attack in the previous year (BlackBerry 2024)
• SBOM Mandate: The Cyber Resilience Act makes Software Bills of Materials mandatory from December 2027, with BSI TR-03183 already defining the standard
• Market: German IT security market exceeds 10 billion Euro for the first time, with a 2025 forecast of 11.1 billion (up 10 percent)

What NIS2 Means for the Supply Chain

Article 21 of the NIS2 Directive identifies “supply chain security” as one of the mandatory elements of risk management. The German implementation law (NIS2UmsuCG, in effect since December 6, 2025) translates this into three concrete obligations in Section 30 of the BSIG.

Firstly: security requirements for IT procurement. Every procurement process must demonstrate documented standards and secure development practices of suppliers. Secondly: contractual security requirements for external service providers, including a contractually anchored audit right. Thirdly: Supply Chain resilience – companies must analyze single points of failure in their supply chain and have alternatives in place.

The ENISA Technical Implementation Guidance from June 2025 specifies: a supplier register is mandatory and must be regularly updated. For each supplier and service provider, a documented risk assessment must be available. And contracts must not only contain security clauses but also ensure the practical enforceability of these clauses. The audit right is not just a formality – it must be actively exercised.

The scope is significant: around 29,000 companies in Germany fall under NIS2 – six times more than the approximately 4,500 under the predecessor NIS1. And for all these companies, the requirements apply without a transition period. Compliance has been expected since December 2025.

Sources: Bitkom Wirtschaftsschutz 2024, OpenKRITIS, BlackBerry 2024

XZ Utils: The Anatomy of a Perfect Attack

The XZ Utils backdoor (CVE-2024-3094, CVSS Score 10.0 – the maximum value) is the textbook example of supply chain attacks in the open-source sector. An actor under the pseudonym “Jia Tan” began contributing to the XZ Utils project in 2021. Over two years, he systematically built trust, became a co-maintainer, and then implanted a backdoor in versions 5.6.0 and 5.6.1 in February 2024.

The backdoor would have enabled remote code execution via SSH – on any Linux system that had the affected versions installed. Affected were Fedora, Debian, openSUSE, and Kali Linux. The backdoor was discovered by Andres Freund, a Microsoft engineer, who noticed unusually high CPU consumption during SSH connections. By chance. No security scanner, no audit, no SBOM detected the backdoor.

This is the core of the supply chain problem: trust cannot be automated. An attacker with enough patience can infiltrate any open-source supply chain. The only defense is systematic reviews, multiple maintainer checks, and SBOM-based transparency – exactly what NIS2 and the Cyber Resilience Act are now demanding.

And XZ Utils was not an isolated case. Cyble documented ninety confirmed attacks on software supply chains between February and August 2024 alone – on average, at least one attack every other day. The average cost of a supply chain breach is 4.91 million dollars globally. The MOVEit debacle from summer 2023 primarily affected US companies (78.9 percent of known victims), but German organizations were also affected. The lesson: geographical distance does not protect against supply chain attacks because supply chains are global.

The Regulatory Trio: NIS2, CRA, and BSI TR-03183

Three regulatory frameworks interlock and make supply chain security a hygiene standard in Germany.

NIS2 (immediately, since December 2025) regulates the organizational side: supplier registers, risk analyses, contractual security, and audit rights. Anyone falling under NIS2 must document and secure their supply chain.

The Cyber Resilience Act (CRA) regulates the product side. In force since December 10, 2024, it takes effect in stages: from September 2026, vulnerabilities and incidents must be reported. From December 2027, all requirements will be fully applicable – including security by design and mandatory SBOMs for all “products with digital elements.” This affects not only IoT devices but also industrial software and its components.

BSI TR-03183 defines the technical standard for SBOMs in Germany. Version 2.1.0 specifies: CycloneDX (from v1.6) or SPDX (from v3.0.1) are the mandatory formats. For each component, creator, name, version, filename, and all dependencies must be documented recursively. Companies that already implement TR-03183 are prepared for the CRA requirement from 2027.

The consequence: anyone without functional SBOM management by the end of 2027 will no longer be able to legally sell their products on the EU market. For German industrial companies and software manufacturers, this is not just a compliance issue but an existential market access requirement.

TISAX and the Automotive Industry: Supply Chain Security as a Market Access Criterion

The automotive industry demonstrates how Supply Chain Security evolves from a compliance requirement to a competitive tool. TISAX (Trusted Information Security Assessment Exchange) is the industry-specific standard based on the VDA Information Security Assessment (ISA). As of 2024, version ISA 6.0 is mandatory for all new assessments, and by 2025, it will be the exclusive version.

What ISA 6.0 brings: an explicit distinction between IT and OT security, new confidentiality labels (“Confidential” and “Strictly Confidential” instead of the old “Info High” and “Info Very High” levels), and three assessment levels – from self-assessment to penetration tests and site visits.

For SMEs in the automotive supply chain, TISAX has become a market access criterion. Companies with a TISAX label receive preferred supplier status from OEMs. This is not a theoretical advantage: in practice, suppliers report that, thanks to existing certification, they were able to forego separate security audits by the OEM – the client accepted the standardized proof documentation. Less audit effort, faster order placement, higher trust.

The pattern can be applied to other industries: those who proactively build and document their NIS2 compliance save their customers the effort of their own audits. Compliance becomes a sales service element. Siemens is a prime example: as a founding member of the Charter of Trust and with its own Cyber Emergency Response Team, the company offers NIS2 support as a service to customers. Compliance is not a cost factor but an upselling channel.

The effect is amplified in international business relationships. European customers who must keep sensitive data within the European legal framework increasingly prefer suppliers with demonstrable European compliance. In tender procedures and contract renewals, the ability to present a NIS2-compliant security roadmap can be the difference between award and rejection. This is not a soft skill; it’s a measurable sales advantage.

The Damage Report: Why Waiting is Not an Option

The numbers are clear. According to Bitkom Wirtschaftsschutz 2024, 81 percent of all German companies were affected by data theft, device theft, or sabotage. Another 10 percent suspected it. The total damage: 266.6 billion Euro, a record and 29 percent more than the previous year. Two-thirds of this (178.6 billion Euro) was attributed to cybercrime.

Supply chain-specific: 13 percent of German companies reported that suppliers were victims of data theft, espionage, or sabotage in the previous year. Another 13 percent suspected it. Of those affected, 44 percent suffered from supply bottlenecks, production failures, or reputational damage. These are not hypothetical risks; they are ongoing losses.

Globally, the numbers are even more drastic: according to BlackBerry, 75 percent of organizations experienced a software supply chain attack in the previous year – three times more than Gartner had predicted for 2025. Cybersecurity Ventures estimates global damage from software supply chain attacks at $60 billion for 2025, with an increase to $138 billion by 2031.

The maturity of defenses is not keeping pace with the threat. According to the Prevalent Third-Party Risk Management Study 2024, while 83 percent of companies describe their TPRM program as “established,” only 39 percent rate their risk minimization as “highly effective.” Less than a third have been running their TPRM program for more than five years. And only 43 percent say their third-party risk management is adequately staffed. The gap between “we have a program” and “the program really protects us” is significant.

IT Baseline Protection and ISO 27001: The Foundation for Supply Chain Compliance

Companies already certified according to BSI IT Baseline Protection have a significant head start in implementing NIS2. IT Baseline Protection is considered a recognized framework for demonstrating NIS2 compliance in Germany. The compendium comprises over 200 modules in ten layers, including specific modules for outsourcing (OPS.2.3 for customers, OPS.3.2 for providers), which directly address the supply chain obligations of NIS2.

ISO 27001 based on IT Baseline Protection (BSI certification) is the strongest single compliance proof that a German company can provide for its supply chain security. Unlike a pure ISO 27001 certification, the BSI variant requires the complete implementation of the Baseline Protection Compendium – a significantly higher requirement, but also a significantly stronger signal to customers and regulators.

In parallel, the NIST Secure Software Development Framework (SSDF, SP 800-218) defines four practice areas – Prepare, Protect, Produce, Respond – which seamlessly interlock with the CRA requirements. Companies that implement SSDF significantly ease CRA compliance because CRA demands “Security by Design” and SSDF provides exactly the operational framework for it. Version 1.2 has been in public comment since December 2025.

For the typical German mid-sized company with 500 to 5,000 employees, this means: IT Baseline Protection as a basis, building on it SBOM management according to BSI TR-03183, and prospectively SSDF practices for their own software development. This sounds like a lot, but the alternative – proving to each customer and in each audit that the supply chain is secure – is many times more expensive.

From Compliance Pressure to Competitive Advantage: How it Works

The transition from a mandatory program to a strategic advantage takes place in three phases.

Phase 1: Establish a Baseline. Build a supplier register, conduct risk analyses, adjust contracts. This is the compliance part that NIS2 demands since December 2025. Most companies are still stuck here.

Phase 2: Offer Transparency as a Service. Companies that document their own supply chain posture and proactively communicate it to customers save them the effort of their own audits. This works particularly well with BSI IT Baseline Protection certification (as recognized NIS2 proof) or ISO 27001 based on IT Baseline Protection.

Phase 3: Monetize Compliance. The cyber insurance market shows the way: companies with proven supply chain security pay lower premiums. Customers award contracts faster because audit overhead is eliminated. And in exports, BSI certification becomes a door opener – internationally recognized via SOGIS-MRA and CCRA.

The German IT security market exceeded the 10 billion Euro mark for the first time in 2024 (10.1 billion Euro). Bitkom forecasts a rise to 11.1 billion Euro for 2025 – plus 10 percent. A significant part of this growth flows into supply chain security. Companies that invest now position themselves not only compliant but profitable.

The European SBOM market alone is expected to grow from 392 million dollars in 2024 to 1.37 billion dollars by 2031 – an annual growth of 16.7 percent. Whoever builds SBOM competence today will have a lead in three years that pays off in consulting mandates, product differentiation, and sales speed. Supply chain security is not a cost center. It is a market that grows faster than almost any other segment of IT security.

The best news for German companies: the regulatory framework is stricter than elsewhere, but that is exactly what creates the competitive advantage. Whoever survives and masters the German regulatory density – NIS2, CRA, BSI TR-03183, TISAX – has a governance level that international customers and partners appreciate. The compliance burden becomes a quality seal. Provided one takes it seriously and implements it, instead of lamenting it as bureaucratic overhead.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

What are NIS2’s specific requirements for the supply chain?

A supplier register with documented risk assessment, contractual security clauses with audit rights, and continuous monitoring of supplier risks. In Germany, these obligations have been in effect since December 2025 without a transition period.

What is an SBOM and why is it becoming mandatory?

A Software Bill of Materials lists all components of a software, including versions and dependencies. The Cyber Resilience Act makes SBOMs mandatory from December 2027. BSI TR-03183 already defines the standard in CycloneDX or SPDX formats.

How many companies in Germany are affected by NIS2?

Around 29,000 companies, six times more than under the predecessor NIS1 (approximately 4,500). The expanded scope includes essential and important entities in 18 sectors.

How can Supply Chain Security become a competitive advantage?

Companies with documented NIS2 compliance save their customers the effort of their own security audits. BSI certifications are internationally recognized. And cyber insurers offer lower premiums when Supply Chain Security is proven.

What is the connection between NIS2, CRA, and BSI TR-03183?

NIS2 regulates organizational supply chain security (since December 2025), CRA regulates product security (fully effective from December 2027), and BSI TR-03183 defines the SBOM standard. Together, they form a regulatory trio that makes Supply Chain Security a hygiene standard.

Read more

• NIS2 as a location advantage: Why cybersecurity regulation strengthens the business location
• Cyber insurance 2026: Why the market is the most honest security indicator
• AI governance on the board: Between innovation and regulation

Source title image: Pexels / Tiger Lily (px:4483610)