Customers send NIS2 questionnaires because Article 21 of the directive requires essential and important entities to manage supply chain risk, and you are part of their supply chain. Answer by mapping to the Article 21 measures, state exactly what you do and hold, and attach evidence. There is no NIS2 certificate to claim.
This explains the legal hook, gives a structure for answers and flags the wording mistakes that cost deals. It is not legal advice. Whether the directive applies to you directly depends on national law and your sector, so ask counsel.
Why are you getting these questionnaires?
NIS2 is Directive (EU) 2022/2555. Article 21(2) says the risk-management measures must be based on an "all-hazards approach" and cover at least ten areas, including supply chain security. Article 21(3) says that when entities choose measures under the supply chain point, they must consider the weaknesses of each direct supplier and provider, their overall product quality and security practices, "including their secure development procedures."
That last phrase explains the questions about your development process. The customer is documenting that it considered you. Article 20 adds that the management bodies of those entities approve the measures and can be held liable for infringements, which is why the questionnaire often lands on someone senior.
What are the ten measures to map to?
From Article 21(2), paraphrasing the quoted headings:
- Policies on risk analysis and information system security.
- Incident handling.
- Business continuity, backup management, disaster recovery and crisis management.
- Supply chain security, including relationships with direct suppliers and service providers.
- Security in acquisition, development and maintenance of network and information systems.
- Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
- Basic cyber hygiene practices and cybersecurity training.
- Policies and procedures on cryptography and, where appropriate, encryption.
- Human resources security, access control policies and asset management.
- Multi-factor authentication or continuous authentication solutions, and secured voice, video and text communications.
Build one answer library keyed to these ten and reuse it. Most NIS2 questions are these ten, reworded.
How should an answer be written?
Use a fixed shape: what we do, how we know, evidence, date.
Weak: "We take supply chain security seriously and follow best practices."
Strong: "We keep a software bill of materials for each release, scan it against public vulnerability data on every build, and track fixes to closure. Evidence: sample SBOM and the last quarter's remediation report, attached. Reviewed 18 October 2026."
For the development and supply chain items, which Article 21(3) singles out, be concrete: how you inventory components, how you learn of vulnerabilities, your fix targets and your disclosure process, including whether you publish a vulnerability disclosure policy.
What wording mistakes cost deals?
- Claiming NIS2 compliance or certification. The directive imposes duties on entities. It is not a certificate you hold. Say which measures you implement.
- Mixing up what you hold. If you have an ISO 27001 certificate, give the certificate and its scope. If an audit is in progress, say in progress, not done. Never round up.
- Answering for the whole company when the scope is one product. State the scope.
- Promising what is outside your control. Do not commit to a customer's incident reporting deadlines unless your contract says so. Say how and how fast you notify them.
- Stale evidence. A policy dated three years ago reads as neglect.
What to do
- Ask the customer which national law and which entity category they are working under, and whether the questionnaire is based on Article 21.
- Build the ten measure answer library and assign an owner to each.
- Attach evidence: policies, SBOM sample, scan and fix records, training logs, test results.
- Get a second person to check every claim against the evidence before sending.
- Record the date and version of each answer so the next questionnaire starts from the same text.
- Keep a list of items you cannot answer, with your plan and date, and share it honestly.
- Review the library every six months and after any major change.
Quick check
Can a vendor be NIS2 certified?
We found no NIS2 certificate in the directive text. The directive sets duties for entities, so describe the measures you implement instead.
Which NIS2 article drives supplier questions?
Article 21, especially paragraph 2 point on supply chain security and paragraph 3 on assessing direct suppliers.
Sources
Last reviewed: 18 October 2026.
