Online marketplace: turning a gap list into Art. 21 measures, and settling the shared-responsibility argument
Medianova Marketplace B.V. is a Dutch online marketplace with 140 employees, 9.5 million monthly active users in the Union and EUR 180 million in annual transaction volume; it is an important entity as a digital provider. The platform runs in a single EU cloud region, with a second region used only as a database replica held by the same provider under the same account. An internal review found: administrator accounts use a password plus one shared TOTP token kept in the operations team's password vault; customer personal data and all backups are stored unencrypted at rest; container images are never scanned and the patching window is quarterly; 14 of 22 critical suppliers have no security clauses, including the content delivery network and the payment service provider; phishing simulation runs only in the Amsterdam office; the only disaster recovery plan in existence is the colocation provider's own plan, and it has never been tested for the platform. The CTO's position is that the company is a software business, that most of this belongs to the cloud provider under the shared responsibility model, and that the review list is 'an infrastructure team backlog, not a compliance issue'.
1. Map the gaps to specific measures in Art. 21(2) and rank them. Explain how you rank, and why the ranking is not the same as the order in the Directive.
Read the worked answer
Mapping.
- Shared TOTP token → Art. 21(2)(j), secure use of multi-factor authentication; also (i) access control.
- Unencrypted data and backups → (h) cryptography and encryption.
- No image scanning, quarterly patching → (i) asset management, vulnerability handling and disclosure.
- The DR plan question → (c) business continuity, backup management and crisis management; plus (b) incident handling capability.
- Untested recovery, single-region dependency → (c) again, and (f) assessment of effectiveness.
- 14 unclaused suppliers → (d) supply chain security, plus (e) security in acquisition and development.
- Single-office phishing simulation → (g) cyber hygiene and training.
- No referenced risk analysis → (a).
Ranking criterion: the product of likelihood and consequence to the service, weighted by how much the control changes the outcome of the most probable incident (credential theft leading to ransomware or data theft).
Order: shared admin MFA first, because it is the control most likely to prevent the most likely incident; tested, immutable, restore-capable backups second, because it determines whether a successful ransomware event is an outage or a disaster; then supplier assessment of the payment provider and the CDN; then vulnerability management with severity-based SLAs; then encryption and training.
Why this differs from the Directive's list order. Art. 21(2)(a)–(j) is an enumeration of required categories, all of which must be addressed, not a priority sequence. Priority is set by the entity's own risk analysis under 21(1) and 21(2)(a), and a supervisor will judge the ordering against that analysis rather than against the lettering.
2. Set out what Art. 21(3) requires for supply chain security and describe how you would handle the 14 suppliers that have no security clauses, in a company with no procurement policy.
Read the worked answer
The obligation. Art. 21(2)(d) requires supply chain security, and Art. 21(3) makes it concrete: the entity must address vulnerabilities specific to each direct supplier and service provider, and take account of the overall quality of the products they supply and of their cybersecurity practices, including secure development procedures. The test is not 'do we have clauses' but 'can we demonstrate that we assessed each direct supplier against the risk it creates for us'.
How to get there from zero, fast.
- Tier the 22 suppliers by access and dependency. Tier 1 = holds or can reach customer or payment data, or single-sources a function on the critical path. The payment service provider and the CDN are unambiguous Tier 1: the PSP touches payment data and settlement; the CDN is in front of every request, so its compromise is everyone's outage.
- Assess Tier 1 against a short evidence set, not a 200-question security questionnaire: their current independent assurance report, their incident-notification commitment, their sub-processor transparency, their patch and vulnerability statement, and their data location.
- Contract on renewal, not on principle. Clauses that should appear in every new or renewing agreement: security requirements by reference to a defined baseline, incident notification with a time limit, right to information and audit, sub-processor approval, data location and return/deletion, and termination for material security failure.
- Record refusals as decisions. When a supplier refuses a clause, document the compensating measures and the accepted residual risk. A supervisor's real question is not 'did every supplier sign' but 'what did you do when one would not'.
- Include the cloud provider in the same exercise. It is a supplier, and its certifications are inputs to your assessment, not a substitute for it.
Note the scope of NIS 2 here. These duties fall on Medianova as an important entity. Its own customers - if any of them are essential entities - will be running the same exercise on Medianova.
3. The CTO argues that the shared responsibility model transfers most of these gaps to the cloud provider. Construct the response, including where a cost or proportionality argument genuinely has force.
Read the worked answer
The legal position first. Art. 21(1) places the obligation on the entity. NIS 2 recognises shared responsibility as a technical fact, not as a transfer of legal liability: contracting out does not move the duty. The cloud provider secures the physical slab and the hypervisor; it does not configure your identity policies, hold your encryption keys, or detect anomalies in your workloads.
Three concrete rebuttals mapped to this setup.
- Identity. The shared TOTP token is an account configuration in the tenant. No provider setting prevents it, and no provider will fix it. A per-user, phishing-resistant second factor for administrators with conditional access and a break-glass procedure is squarely the entity's control.
- Cryptography. Encryption at rest is offered by the provider but is switched on, scoped and key-managed by the tenant. If the keys sit with the same provider account as the encrypted backups, a single account compromise defeats both - which makes key custody an entity decision.
- Recovery. The second region being a replica under the same provider and the same account is not a recovery capability; it is a correlated failure. The provider's DR plan covers the provider.
Where the proportionality argument does have force. Art. 21(1) requires measures proportionate to exposure, size and cost. For a 140-person company, refusing an active-active multi-region architecture with a 15-minute RTO while implementing tested restores with a documented four-hour RTO is a defensible position - provided it is written down as a decision with residual risk accepted. Refusing per-user MFA is not: it is cheap, standard, and the risk it removes sits at the centre of the most likely incident path.
Framing for the CTO. The backlog is the compliance issue only in part; the real exposure is that the controls nobody else can implement for Medianova are the ones currently missing.