Your customer asks about NIS2, even if you are not subject to it yourself
You receive a security questionnaire because your customer must ask it, not because you yourself are subject to the directive. This changes what is expected of you.
Why you receive this questionnaire
Directive (EU) 2022/2555 — NIS2 — requires organisations in certain sectors to manage the security of their supply chain. They must therefore set requirements for their suppliers, and those requirements reach you as a questionnaire.
You are not yourself subject to the directive. But you cannot skip the questions: your customer must be able to demonstrate that he asked them.
What the questionnaire asks about
Whether there is policy for risk analysis and the security of information systems. Whether there is a procedure for handling incidents. Whether there are back-ups and emergency provisions to restore service delivery.
And — this is the question that is often underestimated — whether you yourself set security requirements for your own suppliers. The chain continues, and he passes this question to you just as your customer passed it to him.
Yes without substantiation does not count
In these questionnaires, a document is requested more often than in the other two: a policy, a procedure, a test report of the recovery provision. A ticked box without a document behind it comes back in the next round.
Who is behind it
supplia.eu is a service of Point2Create BV, Energieweg 1, 3133 EB Vlaardingen (KvK 63324547). Questions can be directed to office@supplia.eu.