Energy and critical infrastructure: compliance pressures on suppliers

If you supply an energy operator or a designated critical national infrastructure (CNI) entity, the operator's regulatory obligations do not stop at their perimeter. They flow down to you through contract clauses, questionnaires, and audit rights. This article sets out where those obligations come from and what a supplier should have ready before the next tender or assessment.

We covered this ground in a practical session with DLA Piper on the CER Directive. The working position from that event: if you already run a quality management system, you hold a large part of the foundation. The task is to find where you need to build further, and to check for overlap with standards such as ISO 9001, ISO/IEC 27001, and ISO 31000. The route from a working standard to demonstrable compliance runs through four steps: map your existing management system, certificates, and documentation; run a gap analysis clause by clause against the CER law, marking each item covered, partly covered, or a gap; prioritise the gaps into a report aligned to the statutory deadlines; and turn that into a concrete action plan for risk assessment and resilience.

Where the pressure comes from

CNI operators sit under a stack of rules. In the EU, the NIS2 Directive expands the number of regulated entities and makes management personally accountable for cybersecurity risk. The Critical Entities Resilience (CER) Directive covers physical resilience. In the UK, the NIS Regulations apply to operators of essential services in energy, water, transport, and digital infrastructure. Energy has sector rules on top, including network codes and, for electricity, the NIS network code on cybersecurity.

None of these frameworks let an operator ignore its supply chain. NIS2 requires entities to address supply chain security and the security practices of their direct suppliers. That requirement becomes your requirement, expressed as contract terms you must meet.

What CER adds to the picture

The CER Directive treats resilience as more than cybersecurity. It requires critical entities to assess risks to physical operations, to withstand disruption, and to recover and continue delivering essential services after an incident. Member States designate the critical entities, and those entities must conduct risk assessments, take technical and organisational measures, and report significant incidents.

CER and NIS2 are meant to work together. NIS2 covers the digital side; CER covers physical resilience and service continuity. Where you supply a designated critical entity, expect both strands to appear in your contract: cybersecurity controls on one side, and continuity and physical resilience expectations on the other. A supplier that only prepares for cyber questions will be caught out by a resilience question.

For a supplier, the practical consequence is this. You may be asked to show not only that you protect data and systems, but that you can keep delivering your part of the service during a disruption. That means a business continuity plan, defined recovery objectives, and evidence that you have tested them. Treat resilience evidence as a separate deliverable, not a footnote to your security documentation.

How obligations reach the supplier

Expect the flow-down to arrive in three forms. First, contract clauses: security requirements, breach notification windows, audit rights, and subcontractor controls. Second, pre-award questionnaires that ask you to evidence your controls before you win the work. Third, ongoing assurance, where the operator reassesses you on a schedule or after an incident.

Notification windows are tighter than many suppliers assume. NIS2 sets a 24-hour early warning for significant incidents at the operator level. If your service is in scope of their reporting, your contract may require you to notify them fast enough for them to meet that clock. Know the number in your contract and build a process that hits it.

What to prepare

Have these ready as documents, not intentions. A current asset and data inventory covering what you hold and where it runs. An access control policy with evidence of enforcement. An incident response plan with defined roles and a tested notification path. A business continuity and recovery plan that reflects CER-style resilience expectations. A subcontractor register, because your supply chain is now part of the operator's supply chain. Records of staff training on security and the specific obligations that apply to the account.

On data location, be able to state where the operator's data is hosted and processed. ComplyTrain hosts in the EU, on AWS eu-central-1 (Frankfurt). We isolate each tenant with a silo model: schema-per-tenant, a Cognito pool per tenant, and a bucket per tenant. State facts like these plainly in your responses. Do not claim certifications you do not hold, since a CNI assessor will ask for the certificate.

From QMS to compliance

Many operators expect a supplier to run a quality management system and to keep training records that survive an audit. A QMS built around a defined standard gives you document control, defined processes, and evidence of competence for the people doing the work. The path from a working QMS to demonstrable compliance is shorter than most suppliers expect: the same document control, process definitions, and training records that run your quality system also answer the operator's assurance questions.

Map the demand to what you already have. Document control covers the version and approval evidence an assessor expects. Defined processes cover your incident response and continuity procedures. Competence records cover staff training. When a questionnaire arrives, a supplier with a functioning QMS is pulling existing records, not writing new ones under deadline.

ComplyTrain is a general tool for becoming compliant with any standard you train it against. You can run it around ISO 9001, and we have added NIS2 and CER as worked examples so you can see the same engine applied to supply-chain and resilience requirements. The training modules record who was trained, on what, and when. See how the features map to a management system on our ISO 9001 page, and review the surrounding supply-chain and resilience requirements on our critical infrastructure page.

The practical takeaway

Treat the operator's compliance obligations as your contractual obligations, because that is what they become. Keep your evidence current, know your notification windows, prepare for resilience questions as well as security questions, and be honest about what your controls do. Suppliers that can produce the documents on request stay on the approved list. Suppliers that cannot are quietly dropped at renewal.

Book a demo to see how ComplyTrain's QMS and training records help you meet supplier obligations in energy and CNI.