A customer under NIS2 sent you a security questionnaire

What you can send back

1. Your own result from the scope checker. It shows if NIS2 applies to you directly.
2. A certificate, if you have one. Send the certificate and its scope statement. The scope tells the customer which services it covers.
3. A short description of your measures: access control, backups, logging, incident handling, supplier checks.
4. Your incident contact and the time you need to inform the customer.

What customers usually ask for

• A completed security questionnaire.
• A contract clause that obliges you to report incidents that affect the customer, with a deadline in hours.
• A right to audit, or a report from an independent audit.
• A certificate, most often ISO 27001, sometimes a SOC 2 report.
• A list of your own critical suppliers and where the data is stored.

Why the customer asks

Article 21 of the Directive lists the measures every entity in scope must take. One of them is supply chain security:

supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;

The customer passes part of that duty to you through the contract.

When a supplier is in scope after all

• Your own activity is in Annex I or II and you are medium-sized or larger. Managed IT and security services are Annex I activities.
• You are in Italy, you belong to the same group as an NIS entity, and you run its IT or security. Italy brings you into scope at any size.

What the authorities say

Belgium

The CCB advises every supplier of an NIS2 entity to meet at least the CyberFundamentals Basic level.

Netherlands

The explanatory note to the government-sector rules says there is no de facto duty for entities to ask suppliers for a certificate.

Germany

The BSI says no general certificate proves compliance with the BSIG.