Were you sent a NIS2 questionnaire?
Your customer is subject to NIS2 and has to manage the risks that come from its suppliers. So it asks you to show how you protect its data and your systems. This guide explains why, what you will be asked, and how to answer once.
Why you receive it
The NIS2 directive requires the entities it covers to secure their supply chain (Article 21(2)(d)). They must take into account the vulnerabilities specific to each direct supplier and the quality of its cybersecurity practices (Article 21(3)). The questionnaire is how your customer does that. Receiving one does not mean the directive applies to you.
What you will be asked
Questionnaires almost always follow the ten measures of Article 21(2). For each one, here is what answers it best.
Risk analysis and security policies
An information security policy and a risk analysis, even short ones.
Incident handling
A procedure: who detects an incident, who decides, who tells the customer, and how fast.
Continuity, backups and crisis management
Your backup policy and recovery plan, with the date of the last test.
Suppliers and the supply chain
The list of your subprocessors, with their purpose and region.
Building and maintaining systems, including vulnerabilities
How you apply patches, and how someone can report a vulnerability to you.
How you check that the measures work
What you check and how often: annual review, audit, penetration test.
Basic hygiene and training
Your basic rules (updates, passwords, phishing) and staff training.
Cryptography
What is encrypted, in transit and at rest, and how.
People, access and assets
Who has access to what, how access is granted and removed, and your asset inventory.
Authentication and secured communications
Where multi-factor authentication is enforced, and which communication tools you use.
The answers template follows these ten measures, one section each. Start from the answers template
Answer once, not for every customer
The same questionnaire will come back, from another customer and in another format. Publish your answers and documents on a trust center: you send a link instead of filling in a spreadsheet. What should not be public opens only on request, and every version stays dated.
Are you subject to NIS2 yourself?
It depends on your sector and size, and each member state transposes the directive its own way. In Belgium, the Centre for Cybersecurity Belgium (CCB) offers a NIS2 scope test: that is the source to check.
CCB website (opens in a new tab)Frequently asked questions
- Do I need a certification to answer?
- No. A customer may ask for one, but the directive does not require it of suppliers. What matters is being able to show what you do, with documents to back it up.
- What about CyberFundamentals?
- In Belgium, many customers rely on the CCB’s CyberFundamentals framework and may ask you for a level: Basic, Important or Essential. CyberFundamentals explained
- Do my answers have to be public?
- No. A privacy notice or a subprocessor list can be; a penetration test or a continuity plan opens only to the people you grant access to.