No. NIS2 follows a risk-based approach.

Organizations should focus on:

  • Critical suppliers
  • Suppliers with access to systems or data
  • Providers of ICT services

👉 Not all vendors require the same level of assessment.