In het Nederlands: antwoordbank leveranciersvragenlijst →
Supplier Security Questionnaire Answer Bank (NIS2): answer your customer's security questionnaire honestly and quickly
Customers covered by NIS2 must assess the security of their direct suppliers (Directive (EU) 2022/2555, art. 21(2)(d) and 21(3)). So suppliers of IT, software, hosting, consulting and other services now get questions about MFA, backups, patching, incidents and subcontractors, even when they are not covered by NIS2 themselves. Largely the same questions keep coming back. This answer bank gives you an honest model answer for each one, matched to your situation: in place, partly in place, or not yet.
What's inside (every file in English and Dutch)
- Answer bank (.xlsx) — 63 questions customers commonly ask, in 15 topics. For each: three model answers with fill-in fields (in place / partly in place / not yet, planned), the evidence to attach, and a mapping to NIS2 art. 21(2)(a)–(j) and ISO/IEC 27001:2022 Annex A. Pick your status and the matching answer appears. Includes a summary tab and an evidence checklist (21 items, with advice on what to send, what to share on request and what only under NDA).
- Guide (.docx) — how to work through a questionnaire, and how to answer honestly when something is not in place yet, with weak-versus-better example answers.
- Cover letter (.docx) — a one-page reply with optional paragraphs and a check before you send.
- Bonus: AI assistant — copy-paste prompts that let Microsoft 365 Copilot, ChatGPT, Le Chat, Claude or Gemini match a customer's questions to your own answer bank and write first versions of the replies. Anything not in your bank is marked as a gap for a person, never invented. Plus a Claude skill and instructions for your own GPT or Copilot agent.
Every file comes in English and in Dutch. Works in Excel, Word, Google Sheets/Docs and LibreOffice. Instant .zip download after purchase.
Also need a scope check, a self-assessment and a security policy? The NIS2 Supplier Kit (EU) (€69) covers those, with a shorter answer kit of 8 questions.
Who this is for
- IT partners, software vendors, hosting companies, consultants and other service providers with a customer that falls under NIS2, anywhere in the EU.
- Freelancers and small businesses who received a questionnaire and are unsure how far to go.
- Anyone who does not want to start from scratch with every new customer.
FAQ
- Not everything is in place yet. Is this still useful?
- Yes, especially then. Every question has a model answer for "partly in place" and "not yet (planned)" that gives a date and says what you already do, and the guide explains how to write that honestly. You never have to tick a box that isn't true.
- My customer uses its own form. Does this fit?
- The answer bank is not a form to send, it is your source: for each of the customer's questions you find the matching question in the bank, adjust the answer and paste it into the customer's form.
- Is this part of the NIS2 Supplier Kit?
- The NIS2 Supplier Kit contains a short answer kit with 8 questions. This answer bank is the full version: 63 questions, three answer levels, evidence checklist, guide and cover letter, in two languages.
- Is this legal advice?
- No. It is a template. It does not guarantee that a customer accepts your answers or that you meet any law or standard. Only fill in what is true for your organisation.
Further reading (free articles)
Template, not legal advice. It does not guarantee that a customer accepts your answers or that you meet any law or standard. Based on Directive (EU) 2022/2555; sources with check dates are in the guide. Prepared with the help of AI under the direction of Lerider Technologies and checked against the cited legal sources before publication.
Refunds: if this isn't useful for you, email within 14 days of purchase for a full refund, no questions asked.
At checkout you accept our terms (Dutch, with an English summary). See also refunds and privacy.