The Cybersecurity Act V2 (CSA V2), expected to be fully implemented by 2027, will fundamentally change how European organizations manage their ICT supply chains. For CISOs, this means mandatory vendor risk assessments must include ownership structure and country-of-origin analysis, not just technical security controls.
Starting in 2027, organizations classified as essential or important under NIS2 will be prohibited from using ICT components from designated high-risk suppliers in critical infrastructure. Mobile network operators have 36 months to replace affected equipment; other sectors will follow.
The immediate impact: procurement processes need updating, existing vendor relationships require auditing, and replacement roadmaps must be developed. Organizations with significant exposure to potentially affected suppliers (currently ~32% of 5G infrastructure in the EU) face substantial transition costs.
CISOs should act now: map your supply chain exposure, implement enhanced vendor due diligence incorporating non-technical risk factors, and align replacement cycles with the transition timeline. Early preparation minimizes disruption and positions your organization ahead of mandatory compliance deadlines.
Recommended advisory: PAC Leadership Session – Cybersecurity Compliance
SHARE :
This Excel document delivers market figures broken down by vertical sectors. Figures cover a seven-year time frame (results from the past two years ...
Event Date : January 22, 2026
This Excel document provides the top 20 Big Data services vendor rankings.
Event Date : December 12, 2024
This document provides market volumes, growth rates and forecasts for the AI market in China for the 2024-2030 period.
Event Date : August 25, 2026
Achieving target-state operational agility requires financial institutions to re-architect legacy calculation pipelines around modular, ...
Event Date : September 11, 2026
Agentic AI is beginning to change how customer service and support operate. It does not replace existing systems or roles but introduces an ...
Event Date : March 09, 2026
Capgemini - Figures - Spain - FY 31-Dec-2025
Datamart September 11, 2026
Capgemini - Vendor Profile - Spain
Vendor Profile September 11, 2026
Atos - Figures - Sweden - FY 31-Dec-2025
Datamart September 11, 2026
Banking: An ROI Guide To Quantum-Inspired Adoption – Market View
Market Reports September 11, 2026
Iver - Figures - Sweden - FY 31-Dec-2025
Datamart September 11, 2026
Atos: Cause for Optimism, Despite the Headlines
Blog Post February 05, 2024
Orange Acquires Obvios’s Dome Technology: Private 5G Becomes Critical Resilience Infrastructure
Blog Post September 09, 2026
Under attack, France changes the rules of cybersecurity for public sector
Blog Post September 04, 2026
Blog Post September 04, 2026
The AI Model Market Is Fragmenting
Blog Post September 01, 2026
Blog Post August 31, 2026