How to answer a NIS2 supplier security questionnaire as a small supplier

Why you received it

The NIS2 Directive (EU) 2022/2555 requires essential and important entities to take cybersecurity risk-management measures, including "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Article 21(2)(d)). Article 21(3) adds that entities must take into account the vulnerabilities specific to each direct supplier, the overall quality of its products and its cybersecurity practices, including secure development. Member States have written this into national law, for example the Dutch Cyberbeveiligingswet, in force since 15 August 2026.

The questionnaire is how your customer shows that it assessed you. It does not by itself bring you into the scope of NIS2. Whether you are in scope depends on your own sector and size: most NIS2 sectors only apply to medium-sized and larger organisations (50 or more staff, or both annual turnover and balance sheet above €10 million), with exceptions such as DNS, trust services and public electronic communications. If you are out of scope, your obligations are what you agree in the contract, not registration or incident reporting to a national authority.

Step 1: pin down the scope before you answer

• Which service is being assessed? A design agency with no system access and a managed IT provider with admin rights are very different risks. Many questions may honestly be "not applicable" for a narrow service, provided you say why.
• Which of the customer's systems and data do you touch? Remote access, hosting, or processing of personal data make the related questions matter most.
• Deadline and format. Ask whether an existing document, such as a security statement or an ISO 27001 certificate, may replace part of the questionnaire.

Step 2: give one of three honest answers per question

Most questionnaires cover the same ground: multi-factor authentication (MFA), patching, backups and restore tests, access management, incident handling, staff awareness, your own suppliers and certifications. For each question, one of three answers is true:

A "partly" or "not yet" with a date and an interim measure is easier for a customer to assess than a "yes" that turns out to be wrong during an audit or an incident. Never claim a level you cannot show.

Step 3: send evidence, but not everything

Evidence makes an answer checkable. For a small supplier it is usually light: a two-page information security policy, a screenshot of an MFA setting, the record of your last backup restore test, a training list with dates, or a certificate if you have one.

Do not send material that would help an attacker: passwords or keys, full network diagrams, IP ranges, or lists of vulnerabilities that are still open. Offer sensitive details for viewing only, or under a non-disclosure agreement. A reasonable customer will accept that.

Step 4: read the contract clauses separately

The questionnaire often comes with a contract annex: notify the customer of incidents within a fixed number of hours, an audit right, or a duty to pass the same requirements on to your own suppliers. Your customer has tight reporting deadlines of its own (under NIS2 Article 23 an early warning to its CSIRT or authority within 24 hours of becoming aware of a significant incident), so it wants to hear from you quickly. That is fair, but check that you can really notify outside office hours, who will do it and through which channel. Propose a deadline you can meet, or a lighter variant where a requirement is out of proportion to the service you provide.

Step 5: turn your answers into a reusable answer file

The next questionnaire will word things differently but ask the same things. Keep your answers by topic, with date, evidence and owner, and review them once a year. Ask your own IT provider, host and software vendors the same questions, so that you can point to their answers or certificates instead of guessing.