Why are our customers suddenly sending NIS2 supplier questionnaires?
Because NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. makes them responsible for the security of their supply chain. Article 21(2)(d) requires entities in scope to address supply-chain security, including the security-related aspects of relationships with their direct suppliers and service providers, and Article 21(3) asks them to take into account each supplier's vulnerabilities, product quality and cybersecurity practices. Their auditors and authorities will ask how they did that, and a questionnaire is the usual first step, often followed by contract clauses on security measures, incident notification and audit rights. See it as a sales question: a prompt, honest and documented answer helps keep the customer. Keep a standard answer pack ready, with policies, certifications if any, incident handling, data location and monitoring. NetSenX gives you evidence for the monitoring part on every plan.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How do we answer “do you have intrusion detection?” on a customer questionnaire?
- What should a company do first to prepare for NIS2?
- How does a small or mid-sized company do a cyber risk assessment for NIS2?
- Has my country transposed NIS2 into national law yet?
- Does NIS2 require multi-factor authentication?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.