NIS2 and DORA require a structured approach to supplier management. Risk assessment must translate into verifiable contractual requirements, periodic monitoring, and concrete evidence. This article analyzes the new ACN FAQs on the supply chain and the Register of Information required by DORA.