questionnaire asks how we map risks in our supply chain

Supply chain risks concern two different questions

The question about supply chain risks asks in practice about two things at the same time, and the questionnaire often does not make that distinction explicit. First: does the organisation itself have visibility into risks that enter through its own suppliers and service providers — think of an IT supplier with access to the network, or a software component from a third party. Second: does the organisation set requirements for those suppliers, and does it monitor them. That second point overlaps with the question of whether the organisation sets security requirements for its own suppliers — often that is literally the same question, only asked elsewhere in the list with different wording.

Whoever is ISO/IEC 27001 certified can usually refer to the control measures for supplier relationships from Annex A — these exist specifically for this part, and an auditor has already assessed them. Without certification, the answer is not automatically "no": what matters is whether a risk analysis exists in which suppliers have been included as a point of attention, even if it is informal. That aligns with the broader question about policy for risk analysis, where supply chain risks are typically a section of, not a separate document. If nothing is documented, then "no" is the honest answer — presenting a yes without an underlying risk analysis, contract clause or supplier inventory does not hold up if the client asks for the supporting document.

Where this comes from: Article 21(2) NIS2

Supply chain security is mentioned as a separate component in Article 21(2) of the NIS2 Directive, among the ten measures listed there. For those who fall under the directive themselves — or under the Cybersecurity Act, the Dutch transposition that enters into force on 15 August 2026 — this is not an optional component but one of the mandatory measures. For those who do not fall under it but still receive the question from a client, it is usually a pass-through of that same requirement: the client must itself be able to demonstrate that it controls its supply chain, and therefore asks for it.