questionnaire asks how we manage risks from our suppliers

Supply chain security is one of the ten mandatory measures

This is not just an additional question: supply chain security is mentioned as a separate component in Article 21(2) of the NIS2 Directive, alongside the other nine measures such as risk analysis, incident handling and access control. The customer asking this is checking whether your organisation also looks backwards: not only your own security, but also that of the parties on which you depend. This aligns with security requirements that the organisation itself imposes on its suppliers — the same principle, one step further along the chain.

In practice, three things are usually asked: do you have a policy or process to assess suppliers for cyber risk, do you impose contractual requirements (such as obligation to report incidents, minimum security levels), and do you monitor this after contract signature. If you don't have that process, "no" with a brief explanation is a perfectly good answer — better than a "yes" you cannot substantiate. If you do have supplier assessment but no separate cyber component, state that precisely: the evidence must match what you enter. An ISO 27001 certificate with Annex A typically covers this topic, so if the organisation is ISO 27001-certified that is often the quickest evidence to provide.

Where this comes from: Article 21(2) and Annex A

The ten measures in Article 21(2) of the NIS2 Directive list supply chain security as a separate point, distinct from general risk analysis. ISO/IEC 27001 elaborates on this in the control measures of Annex A, specifically addressing supplier relationships and the requirements you impose on them. The Cybersecurity Act transposes this obligation into Dutch law and comes into force on 15 August 2026 — for now the EU Directive itself is the source, and in practice the customer often asks ahead of this.