NIS2 guide

Answering a customer's NIS2 security questionnaire

A customer that falls under NIS2 must manage the security risks that come from its suppliers. So it may send you a security questionnaire, ask for evidence, or add security clauses to your contract, even if NIS2 does not apply to you.

This guide explains why the customer is asking, what it is trying to find out under each of the ten Article 21 measures, the evidence that answers each one, and what to check before you sign. Article numbers refer to Directive (EU) 2022/2555 (NIS2) unless another law is named.

Last checked 3 November 2026 against the Directive's text and Implementing Regulation (EU) 2024/2690 on EUR-Lex. The quoted words are the law's. The evidence lists are our suggestions: the law sets what the customer must take into account, not what it must ask you. This is not legal advice.

1. Why your customer is asking

Every essential and important entity must take security measures that include:

"supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Article 21(2)(d))

When it decides which measures are right, it must take into account "the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures" (Article 21(3)).

Recital 85 gives the reason: attackers have broken into organisations "by exploiting vulnerabilities affecting third-party products and services". It also says entities in scope "should in particular be encouraged to incorporate cybersecurity risk-management measures into contractual arrangements with their direct suppliers and service providers", and that they "could consider" risks from suppliers further down the chain.

Some things follow from this:

The customer needs facts about you. The Directive does not say how to get them. A questionnaire is one way. A certificate, an audit report or copies of policies are others.
It needs to hear about incidents fast. An entity in scope must send an early warning of a significant incident to its CSIRT or authority within 24 hours of becoming aware of it (Article 23(4)(a)). If an incident at your end affects its service, it needs to know quickly. See NIS2 incident reporting.
Your own suppliers can come up. The duty covers the customer's direct suppliers, and recital 85 lets it look further. Expect questions about the subcontractors and cloud services you use to deliver your service.
Some customers have a detailed rulebook. DNS service providers, TLD name registries, cloud, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, search engines, social networks and trust service providers must follow Implementing Regulation (EU) 2024/2690. Its Annex makes them set criteria for choosing suppliers, including "the cybersecurity practices of the suppliers and service providers, including their secure development procedures" (point 5.1.2), keep a register of direct suppliers with a contact point for each (point 5.2), and review suppliers at planned intervals and after significant changes or incidents (points 5.1.6 and 5.1.7). If your customer is one of these, expect to be asked again.

If NIS2 does not apply to you, it places no duties on you directly. The customer's authority supervises the customer, not you. See section 6 of Does NIS2 apply to your business?

2. Before you answer

Answer for the service you supply. Say which service, systems and locations your answers cover. A question about "your systems" may mean the ones that hold the customer's data, not your whole company.
Answer only what you can show. If the customer asks for evidence later, or writes your answers into the contract, a "yes" you cannot back up becomes a problem. "No, planned for March" with an owner is an answer you can stand behind.
Name one owner. One person collects the answers and the evidence, and keeps them for the next customer.
Agree how documents are shared. Policies and test results show how you protect yourself. Ask how the customer will store them, and use a non-disclosure agreement if you need one.

3. The ten topics and the evidence for each

Article 21(2) lists ten measures, points (a) to (j). A questionnaire built on NIS2 covers the same ground. For each point, this table gives what the customer is trying to find out about you and the evidence that answers it. Each point links to the matching section of our Article 21 checklist.

Point	What the customer wants to know	Evidence that answers it
(a) Risk analysis and security policy	Do you have a security policy that management approved, and a way to find and rank your risks?	The signed policy with its review date; the risk register or a summary; the date of the last risk review.
(b) Incident handling	Will you spot an incident, deal with it, and tell the customer in time?	The incident response plan or a summary; the incident log; a named contact for incidents; how fast you notify customers.
(c) Business continuity	Will your service survive an outage or a ransomware attack, and how fast does it come back?	The backup policy; the date and result of the last restore test; recovery time targets for the service you supply.
(d) Supply chain security	Which of your suppliers and subcontractors touch the customer's data or systems, and how do you check them?	A list of those suppliers and what each does; the checks you make before using one; the security terms you hold them to.
(e) Acquisition, development and maintenance	Do you patch, set systems up securely and handle reported vulnerabilities? If you write software, how do you keep it secure?	Patch timescales and a recent patch report; your secure configuration standard; a vulnerability reporting contact; your secure development steps, such as code review and dependency checks.
(f) Checking the measures work	Do you test your measures, or only write them down?	The last internal review and its actions; any external audit or penetration test summary; management review minutes.
(g) Cyber hygiene and training	Are your staff trained, and do they know how to report a suspicious email?	Training records with names and dates; the signed acceptable use policy; the written steps for reporting a suspicious email.
(h) Cryptography	Is the customer's data encrypted when stored and when sent?	The cryptography policy; encryption in transit for your service; disk encryption on laptops and phones; who holds the keys.
(i) People, access and assets	Who can reach the customer's data, and does access end when someone leaves?	The access control policy; the last access review; your leaver checklist; the asset register; staff screening, if you do it.
(j) MFA and secure communications	Is multi-factor authentication switched on, and can you still be reached if your email is down?	A report or screenshot from your admin console showing MFA enforced; the approved tools for calls and messages; an emergency contact list that does not depend on your email.

4. What counts as evidence

Authorities can ask entities in scope for their documented security policies and for evidence that they are applied (Article 32(2) for essential entities, Article 33(2) for important entities). A customer asking you for evidence is looking for the same two things:

A document shows what you intend: a policy, a procedure or a plan, with an owner, an approval and a review date.
A record shows that it happens: a dated restore test result, a training log, an access review, a patch report, the minutes of a management review.

A record is usually the stronger answer, because it is dated and names who did the work. If you hold a certification, such as ISO/IEC 27001, give the certificate and check that its scope covers the service you supply. Keep each piece of evidence in one place, so the next questionnaire takes hours, not weeks.

5. What a contract clause binds you to

Recital 85 encourages entities in scope to put security measures into their contracts with direct suppliers. If NIS2 does not apply to you, the Directive does not bind you, but a clause you sign does. It binds you as a term of the contract: you must do what the clause says, under the law the contract names, and if you break it the customer has the remedies that the contract and that law give it.

For the digital providers listed in section 1, Implementing Regulation (EU) 2024/2690 says what their supplier contracts must cover. Point 5.1.4 of its Annex requires those contracts to specify, where appropriate:

security requirements for the supplier;
awareness, skills and training, and where appropriate certifications, for the supplier's staff;
background checks on the supplier's staff;
a duty to tell the customer "without undue delay" of incidents that put its systems at risk;
"the right to audit or right to receive audit reports";
a duty to handle vulnerabilities that put the customer's systems at risk;
rules on subcontracting, with the same security requirements for subcontractors;
duties when the contract ends, "such as retrieval and disposal of the information" the supplier obtained.

That list binds only those providers, but it shows the kind of terms any customer in scope may put to you. Before you sign, check:

Incident notice: what counts as an incident, how fast you must tell the customer, how, and what the notice must say. The Regulation says "without undue delay"; a contract may set a fixed number of hours instead. Agree only a time you can meet at weekends and at night.
Audit: whether the customer can audit you or will accept audit reports, how much notice it gives, how often, and who pays.
Subcontractors: whether you need the customer's consent to use them, and which terms you must pass on to them.
Exit: what you must return or delete when the contract ends, and how soon.
Your questionnaire answers: if the contract refers to them, they become promises. Make sure they stay true for the whole term, or say what will change and when.
Liability: whether a security failure falls outside any limit on your liability.

Where a clause asks for something you cannot do, propose a change before you sign. For a large contract, have a solicitor read the security terms.

6. Reporting an incident yourself

NIS2 lets organisations outside its scope report to a national CSIRT (computer security incident response team) or competent authority on a voluntary basis. Article 30(1)(b) covers "entities other than those referred to in point (a), regardless of whether they fall within the scope of this Directive, with regard to significant incidents, cyber threats and near misses". A near miss is an event that could have compromised data or services "but that was successfully prevented from materialising or that did not materialise" (Article 6(5)).

Voluntary reports are handled under the same procedure as mandatory ones, but a country may deal with mandatory reports first (Article 30(2)).
Reporting "shall not result in the imposition of any additional obligations upon the notifying entity to which it would not have been subject had it not submitted the notification" (Article 30(2)). This does not affect the prevention, investigation and prosecution of crimes.
A report to a CSIRT is not notice to your customer. If your contract requires you to tell the customer, do that as the contract says.

Each EU country puts NIS2 into its own law and sets its own reporting channel, so check the CSIRT of the country concerned.

7. What to do next

Read the whole questionnaire and the draft contract before answering anything. Note what the customer asks for as evidence.
Write down the scope of your answers: the service, the systems and the locations.
Go through the ten points in section 3. For each, find the document and the record, or note the gap, who will close it and by when.
Check the contract against the list in section 5, and agree only what you can do.
Keep the answers and the evidence together for the next customer.

UK suppliers selling into the EU can read NIS2 and UK businesses for the other ways NIS2 can reach them.

Our NIS2 Small-Entity Compliance Kit has the documents and registers named in section 3, ready to edit. Its Supplier Security Policy includes eleven contract clauses and a supplier questionnaire of twelve questions, and the licence lets you share the documents with your customers.

8. Sources

Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 6(5), 21, 23, 30, 32 and 33, recital 85.
Commission Implementing Regulation (EU) 2024/2690, EUR-Lex: Article 1 and Annex points 5.1 and 5.2 (supply chain security).