_1762866128417-DS2_OO1j.png)
What changes
| Clause | Change compared with 2015 | Type |
|---|---|---|
| 8.2.1 Customer communication | Communication includes information on contingency actions, explicitly including disruptions to the provision of products or services. | changed |
| 8.4.3 Information for external providers | Requirements communicated also cover the providers' interactions with customers and other relevant interested parties. | changed |
Back in 2015, 8.2.1 already required organizations to establish specific requirements for contingency actions where relevant. What is new is the explicit link to disruptions: what does a customer learn if you cannot deliver as agreed because of a fire, a cyber attack, a supplier failure or a pandemic? Who informs them, how quickly and through which channel?
Clause 8.4.3 highlights a gap in many supplier contracts. External providers often deal directly with your customers: installers, logistics providers, call centres, subcontractors. Their behaviour shapes your company's image. The 2026 edition requires you to cover these interactions too.
Customer communication during disruptions
A good arrangement answers in advance the questions nobody can settle calmly in an emergency:
- Scenarios: which disruptions are realistic, such as IT outage, loss of a key supplier, fire, staff shortage?
- Triggers: when do you communicate, for example when a delivery delay of more than two days becomes likely?
- Responsibility: who decides on the information and who talks to which customers?
- Content: what is communicated: cause, impact, workaround, next update?
- Channels and contacts: are customer contacts up to date and reachable even when your own systems are down?
- Contractual duties: are there customer requirements for notification deadlines, for example in the automotive industry or for critical services?
Extend requirements for external providers
- 1
Identify providers in contact with customers
Flag every provider in your supplier list who comes into contact with your customers or other relevant parties.
- 2
Define expectations
Describe how these providers should act: availability, handling complaints, passing on customer information, data protection, identifying themselves as acting on your behalf.
- 3
Communicate
Include the expectations in purchase orders, framework contracts or service provider handbooks.
- 4
Monitor
Include behaviour towards customers in your supplier evaluation, for example through complaints and customer feedback.
A practical example
An IT service provider manages the networks of around a hundred mid-sized customers. A subcontractor handles part of the on-site work. When a ransomware attack takes down the ticket system, many customers only learn of the problem because promised call-backs never come, and the subcontractor gives contradictory answers on site.
Under the 2026 edition, the provider would have decided in advance that customers are informed within a few hours through a channel independent of the ticket system, who does this and which workarounds exist. The subcontractor would have received a requirement in the framework contract on how to speak to customers in such cases and where to pass on questions. Both are easy to arrange and easy to show in an audit.
Evidence for the audit
- an arrangement or contingency plan with a section on customer communication during disruptions,
- an up-to-date customer contact list that is also available offline,
- evidence from exercises or real disruptions, such as customer notices sent,
- supplier contracts or purchase conditions with requirements for interactions with customers,
- supplier evaluations that take this behaviour into account.
Common mistakes
- Thinking of contingency plans only technically and forgetting customer communication.
- Keeping contact data in the system that fails in an emergency.
- Limiting supplier contracts to price, date and quality of the goods.
- Not carrying customer complaints about service providers into the supplier evaluation.
Implementation in docxpert
The template library includes templates for order handling from enquiry to delivery, for suppliers and external providers, for supplier evaluation and for contingency plans for supply continuity. There you add the sections on communication during disruptions and interactions with customers.
You distribute the approved arrangements with read acknowledgement to the people who act in an emergency. You record customer complaints about service providers in deviation management. The transition check shows how far you are on all changes.
Frequently asked questions
Do I need a contingency plan because of 8.2.1?
The standard requires information on contingency actions in customer communication where relevant. A short section in an existing contingency or continuity plan is often enough.
Which suppliers does 8.4.3 affect?
Mainly external providers who come into contact with your customers or other relevant parties, such as installers, logistics providers, call centres or subcontractors.
Do I have to change supplier contracts?
Not necessarily the contracts. The requirements must, however, be communicated to the provider, for example in purchase orders, framework agreements or a service provider handbook.
How does 8.2.1 relate to NIS2?
NIS2 governs notifications to authorities and, in some cases, to recipients of services. If you are in scope, you can combine customer communication under 8.2.1 with your NIS2 processes.