Answer a NIS2 questionnaire without overpromising

A NIS2 questionnaire is your customer's supply chain duty under Article 21(2)(d) of NIS2, the EU cybersecurity directive that each member state applies through its own law, passed down to you as its supplier. Its answers on incident notice, audit, vulnerabilities, subcontractors and exit can end up in your contract, because a recital of the directive encourages in-scope customers to write security measures into their supplier contracts. Answer for your customer's duty, not as if you were proving your own compliance. Mark the answers that will bind you, and one evidence set can serve every customer without overpromising. The work runs in six stages: find the duty, build the evidence set, mark the contract terms, narrow what exceeds your risk, route approvals and keep the evidence current.

What you need before you start

Gather the documents your answers will sit beside before anyone drafts one, because several of those answers will turn into commitments in the contract that follows.

• The questionnaire, with any covering note on why it was sent: a new contract, a renewal or a periodic review.
• The draft contract, SLA or security schedule that goes with it.
• A short description of the service in scope and a named security contact point.
• Current evidence: certificates and their scope, the security policies behind them, recent independent audit reports and the security testing summaries you share externally.
• The subcontractors behind this service, and what each one handles.

The service description and contact point matter more than they look. Customers covered by Implementing Regulation (EU) 2024/2690, the digital-provider rules described below, must keep a registry of their direct suppliers that records each one's contact point and the ICT products, services and processes it provides. Whatever you write here is what their registry holds.

Three people own the response. You, as bid manager, run it, sign it off, and own accountability for what it promises. Your security lead owns every answer that describes a control. A legal approver owns every answer that will become a contract term, and should see the draft contract at the start, not after the questionnaire is drafted.

Find the customer duty behind the questions

Read the questionnaire as your customer's duty, not yours. Article 21(2)(d) requires essential and important entities to manage the security of their supply chain, including their relationships with direct suppliers and service providers, and the questionnaire is how they do it. That is what a NIS2 questionnaire is: the security questionnaire such a customer sends a supplier before it signs or renews a contract, or during a periodic review. It follows the same response work as any other security questionnaire response; what changes is whose duty it serves and which answers bind you.

Article 21(3) explains a second group of questions. When choosing its measures, the customer must consider the overall quality of its suppliers' products and their cybersecurity practices, including secure development procedures. If your service includes software, expect questions on how you build it, and answer them with evidence of what you do rather than a restatement of policy.

Why an out-of-scope supplier receives one

You receive one because your customer is in scope, whether or not you are. NIS2 covers essential and important entities in sectors such as energy, transport, health, digital infrastructure, ICT service management and manufacturing, and their supply chain duty reaches you as a direct supplier. The customer is assessing the NIS2 supplier risk your service brings, not grading you against the directive. So don't answer as though you were certifying your own NIS2 compliance; answer what the customer needs to record and decide about your service. If your company is in scope itself, your own Article 21 measures run alongside, but they don't change what this customer is asking.

Digital providers under Implementing Regulation 2024/2690

Implementing Regulation 2024/2690 shapes your answers when your customer is a cloud computing, data centre, content delivery network, managed service or managed security service provider, or another digital entity the regulation lists. For these customers, the regulation, made under NIS2, sets the measures in detail, including what their supplier contracts should cover. That gives you precise wording to check each question against, and to point to when you ask to narrow one.

Build one evidence set and map it to each format

Keep one evidence set and map each customer's questions to it, rather than answering every form from scratch. ENISA, in its technical implementation guidance on the implementing regulation, notes that a single piece of evidence may support various requirements. The same logic holds across customers: their forms differ, and so can the national law each one operates under, but one piece of evidence can answer the same question in several forms.

The regulation's recitals say its measures are based on European and international standards, including ISO/IEC 27001 and ISO/IEC 27002. That is why customers ask for ISO-based evidence, and why a current certificate carries many of your control answers, though not all of them.

The questions that recur

The recurring questions follow the customer's duties: secure development from Article 21(3), and the supplier terms the implementing regulation lists for contracts. Map each topic to evidence you already hold.

The last five rows describe what you will do, not only what you have. That is why the next stage treats them as contract terms.

Standard formats you can reuse

Some customers send their own form; others build theirs on a standard question set. Shared Assessments describes the SIG as industry-vetted questions for outsourcers assessing a service provider's controls, and the SIG questionnaire entry sets out what it asks. The Cloud Security Alliance publishes the CAIQ, a yes/no security controls questionnaire now in version 4.1. Through STAR self-assessment, offered at no charge, a cloud provider can submit its completed CAIQ for customers to read.

Keep a completed CAIQ or SIG current as part of your evidence set. Offer it when a customer's form overlaps it, and ask in a clarification question whether it covers part of the form. Then map the remaining questions to the same evidence, so the same fact never gets two different answers. How to answer once and reuse answers across formats covers the mapping itself.

Mark the answers that become contract terms

Mark every answer that commits you to do something later, because those are the answers your customer can carry into the contract. A workable test: an answer is a contract term in waiting if it promises a time, grants the customer a right, obliges you to act when something happens, or sets requirements for your subcontractors. An answer that only describes a control you run today is evidence. It can still be checked, but it describes rather than promises.

For a customer the implementing regulation covers, Annex point 5.1.4 says its supplier contracts specify, where appropriate through service level agreements, a set of terms, including incident notice, audit, vulnerability, subcontracting, and exit topics in the last five rows of the table above.

Customers outside the regulation can still write security terms into the contract, as the directive encourages, so read their questions against the same five topics.

Read the incident question closely. The regulation's supplier term says without undue delay. It gives no hour figure, so for a customer it covers, a count such as 24 hours in a questionnaire or draft contract is the customer's own term, not the regulation's. Before you agree to one, check it against your own incident process: who decides an event is an incident the customer must hear about, how long that decision takes, and what starts the clock. If the figure doesn't fit, propose the regulation's wording, or an hour count that runs from a defined trigger, such as your confirming the incident.

Send every marked answer to legal with the draft contract open beside it. An answer that contradicts the contract, or promises more than it does, is the one to catch now, while it is still a draft.

Narrow questions that exceed your service's risk

Ask to narrow a question when it asks for more than your service's risk warrants, and give a reason the customer can record. Narrowing isn't refusing. The customer still needs an answer to meet its supply chain duty, and a reasoned, narrower answer gives it one; a flat refusal gives it nothing to record.

With customers covered by the implementing regulation, you have wording to point to. Annex point 5.1.4 qualifies its supplier terms with "where appropriate", so the regulation leaves room to fit each term to the supplier it applies to. Ask, in a clarification question, how the customer has assessed your service's risk and which questions apply to it.

The audit term shows how narrowing works in practice. The regulation gives the customer a right to audit or a right to receive audit reports, so a supplier can offer audit reports instead of an on-site audit. Where an on-site audit is out of proportion to your service, offer your independent audit reports in its place, with the scope they cover. For example, if your service has no access to the customer's network or data, you might answer an on-site audit question by offering your latest independent audit reports and asking whether they meet the audit term for your service.

With customers outside the regulation, make the same ask without a rule to cite. Describe what your service touches, propose the narrower answer and let the customer decide. Record what it accepted, because its next review will start from there.

Route each answer to the person who owns it

Route each control answer to your security lead and each contract-term answer to legal, and keep the final sign-off with you as bid manager. The split follows what each answer is. A control answer states how you run security today, and your security lead is the person who knows whether it is still true. A contract-term answer is a promise the company must keep, and legal decides whether it can.

You carry the accountability for the whole response, so your sign-off checks what neither of them sees alone. The answers must agree with each other, with the evidence set and with the draft contract, and nothing you narrowed in one answer can be conceded in another. For example, an audit question answered with audit reports is undone if a later question on subcontractors grants on-site access.

Record who approved each answer, and against which version of the evidence. When the customer's next review arrives, that record tells you which answers still stand and who needs to review the rest again.

In SEQUESTO: in SEQUESTO aOS, each question can carry its own reviewer and approver, so legal approves the contract-term answers, and your security lead approves the control answers before you sign off the response.

Keep the evidence current for the next review

Assign an owner and review date to every item in the evidence set, because the questionnaire comes back. Customers covered by the implementing regulation must monitor and evaluate their suppliers' cybersecurity practices at planned intervals and after significant changes or incidents, and act on what they find where necessary. So the answer to how often you'll re-answer is: at whatever interval your customer has planned, and sooner after a significant change or an incident. Ask for the interval when you sign, and note it beside that customer's answers.

The second trigger matters most for your evidence set. If an incident changes how you notify, patch, or subcontract, every answer describing the old way is out of date, and the customer's next check may come before the renewal does. Refresh the affected evidence after an incident, not only at renewal. The same applies to your contact point: covered customers must keep their supplier registry up to date, so tell them when it changes.

Named owners and review dates on every item turn this from a scramble into routine maintenance. Building an auditable library covers how to set both in the library that holds the evidence set.

In SEQUESTO: each Knowledge Hub item keeps its owner, review cycle and expiry date, and updating a policy flags every answer drawn from it for review, with the policy version each answer came from.

Checklist for each NIS2 questionnaire

Copy this into the response plan and tick each line before you sign off.

• The customer's duty is identified, including whether Implementing Regulation 2024/2690 covers the customer, and the service covered and your contact point are stated.
• Every question maps to an item in the evidence set, and no fact has two different answers.
• Every answer that promises a time, a right, an action or a subcontractor requirement is marked and reviewed by legal against the draft contract, and any hour figure is checked against your incident process.
• Each question that exceeds your service's risk has a narrowing request with its reason, and the customer's decision is recorded.
• Each answer's approver is recorded against the evidence version used, and the whole response is signed off.
• Each evidence item behind the response has an owner and a review date, and the customer's review interval is noted.

Run it on the next NIS2 questionnaire that lands, starting with the answers that will end up in the contract.