the questionnaire asks how we monitor the cyber security of our own suppliers

Supply chain security: what the customer specifically wants to know

This question concerns Article 21(2)(d) of NIS2: the security of the supply chain, including the relationship with each individual supplier. The customer does not want to know whether you yourself are secure, but whether you also require and verify this from your own suppliers. In concrete terms, the questionnaire usually looks for three things: have you included security requirements in contracts with suppliers, do you assess suppliers before engaging them, and do you reassess them periodically. An answer such as "we trust our suppliers" is not evidence for this field — there must be a process behind it.

If you have that process, the evidence is usually a supplier policy or a clause in the standard agreement, possibly supplemented with an overview of assessments carried out. If you do not have that, then "no" is the honest answer here — completing it based on an assumption does not produce a yes, because the file has no source for it. This topic is incidentally related to another field in the same questionnaire: whether the enterprise establishes security requirements for its own suppliers is often asked as a separate question, but the evidence overlaps with what is requested here. Also relevant is whether your own risk analysis includes suppliers as a separate risk category; this aligns with the policy for risk analysis and information security that is inquired about elsewhere in the list.

Basis: Article 21(2) and Annex A

The obligation follows from Article 21(2)(d) of Directive (EU) 2022/2555, which names supply chain security as one of the ten mandatory measures. ISO/IEC 27001 elaborates on this in Annex A, under control measures for supplier relationships: a distinction is made between requirements at the beginning of the relationship and periodic monitoring. For Dutch enterprises, the same obligation appears in the Cyber Security Act, which enters into force on 15 August 2026 as the transposition of NIS2. Whether this obligation applies to your enterprise itself depends on whether you fall within the scope of the directive; this is a different question from what is asked here, and is explained separately under whether the enterprise itself falls under NIS2.