questionnaire asks about risks in our supply chain, what does that mean

Supply chain risks are the security of your own suppliers

Supply chain risks concern the suppliers and service providers you engage, and whether they create a gap in your customer's security. The question doesn't come out of nowhere: it is a literal measure from Article 21(2)(d) of NIS2, which explicitly addresses supply chain security, including the relationship with suppliers. Your customer must be able to demonstrate that they have asked this of their own suppliers — meaning you. That is why the question appears in the list.

In practice, two things are being asked at the same time. First: do you yourself have visibility into the risks that your critical suppliers (hosting, software, IT management) bring? Second: do you set requirements for those suppliers yourself, contractually or otherwise? That second part overlaps with the question of whether your own suppliers must meet security requirements — often that is literally the same question in different wording, so check first whether you had already answered it. If you don't have a formal supplier policy, then an honest "no, not yet" is more accurate than an answer that promises more than exists.

Traceable to Article 21(2)(d) NIS2

This question follows directly from the ten measures in Article 21(2) of Directive (EU) 2022/2555, in which supply chain security appears as a separate element (sub d) alongside risk analysis and incident handling. In the Cybersecurity Act, the Dutch transposition that takes effect on 15 August 2026, this measure appears for entities covered by the law. If you work with ISO/IEC 27001, you will recognize the same requirement in Annex A under the control measures for supplier relationships. Whether your organisation itself falls within the scope of that obligation depends on whether the organisation as an entity falls under NIS2 or the national transposition — that determines whether this is an obligation for you or merely a question your customer passes on to you.