Remote vendor access at an electricity distributor
A Polish electricity distribution system operator with 850 employees serves 1.1 million customers. It is an essential entity in the energy sector. A third-party SCADA integrator has 24/7 remote access to substation control systems through a shared VPN account protected by a password and SMS token. The distributor's NIS 2 risk assessment, approved in 2024, rated supplier access as low because the supplier is ISO 27001 certified. In February, attackers used the shared account to disable telemetry for 14 substations for 36 hours; restoration required manual switching. The distributor's backups were unaffected, but its incident log was stored on the same VPN. The contract with the integrator has no security annex, no right-to-audit clause, and no notification deadline. The board asks whether it can rely on the supplier's certificate and what to fix first.
1. Identify the most important Art 21 risk-management failures and explain why the supplier's certificate does not shift responsibility.
Read the worked answer
The main failures are weak access control, inadequate supply-chain risk management, insufficient monitoring and logging, and poor incident-handling resilience. A shared VPN account violates least privilege and accountability; password plus SMS is weak for privileged remote access; the supplier has broad 24/7 access; logs sit on the same VPN and may be lost in an incident. Rating supplier access as low solely because the supplier holds ISO 27001 is not a proper risk assessment. ISO 27001 certifies the supplier's management system, not the distributor's legal compliance, and it does not transfer the distributor's Art 21 duty. The distributor must assess the supplier's specific access, practices and incident history, impose contractual controls, and monitor performance.
2. What supply-chain measures and contract terms should be put in place?
Read the worked answer
Technically, require unique named accounts, MFA, privileged access management, just-in-time access, network segmentation, session recording, and logging to a collector outside the supplier's VPN. Contractually, add a security annex with minimum controls, vulnerability remediation timelines, incident notification to the distributor within a short defined period, cooperation with the distributor's NIS 2 reporting, audit and access rights, confidentiality, subcontractor controls, and termination rights. The distributor should maintain a supplier risk register, review the integrator at least annually, and test the supplier incident playbook. It should also consider whether a coordinated EU supply-chain risk assessment is relevant for the services used. The certificate can be one input, but not the basis for a low rating.
3. Was the outage reportable, and what should the distributor do about supplier notification and evidence?
Read the worked answer
Telemetry loss for 14 substations for 36 hours is likely a significant incident because it severely disrupted the distribution service and required manual restoration. As an essential energy entity, the distributor should have sent an early warning within 24 hours of awareness, a notification within 72 hours, and a final report within one month, unless national rules add sector-specific steps. The supplier must be required to notify the distributor immediately so that the distributor can meet its own deadline. The distributor should preserve VPN logs, authentication records, change tickets, manual switching records and supplier communications. It should also review why the incident log was reachable through the compromised VPN and fix that resilience gap.