our customer is subject to NIS2 and now sets requirements for us, what does that mean

Your customer passes on the ten measures of Article 21 to you

This means you become part of the supply chain approach prescribed by Article 21(2) of NIS2. An entity falling under NIS2 must itself take 'security measures in the supply chain' — point (d) of that paragraph — and your customer does this by imposing the requirements it sets for itself on you as well. You do not become NIS2-obligated yourself through this questionnaire; you bear the consequences of your customer's obligation. Whether you yourself fall under the directive is a separate question — you answer that separately, for example with the explanation about whether the organisation itself falls under the NIS2 directive.

In practice, the questionnaire translates Article 21(2) into individual questions: do you have risk analysis and information security policies, how do you handle incidents, what about backups and recovery, how do you manage access and use multi-factor authentication, and — the provision your customer is now applying to you — do you also impose requirements on your own suppliers. For each of these points there is a separate explanation in the knowledge base, such as policy for risk analysis and security of information systems and security requirements for own suppliers. If you already have an ISO 27001 certificate, that covers a large part of these questions in one go.

Where this appears in the directive: Article 21(2)

Article 21(2) of Directive (EU) 2022/2555 lists the ten measures explicitly, from policy for risk analysis (a) to security in the procurement of products and services and the supplier relationship (d), to access management and multi-factor authentication (j). The Dutch Cybersecurity Act transposes this directive into national law and enters into force on 15 August 2026; until that date your customer can already shift their own preparation to you, even without the law being in effect yet. Those who recognise the ten measures as separate Annex A controls of ISO/IEC 27001 can take many answers directly from an existing ISMS.