What is changing this year in your customer's cybersecurity questionnaire?
The cybersecurity questionnaires that buyers send to their suppliers are changing in two ways. First, the questions are becoming more specific: instead of a general yes/no question about security policy, an increasing number of buyers are asking for a brief explanation or evidence per topic. Second, these questionnaires are reaching a broader group of companies, including companies that are not themselves directly subject to the NIS2 Directive.
The reason for this is straightforward. Companies that are subject to the Directive must, according to the text of NIS2, also look at the security of their supply chain. They pass this through in their own questionnaires, and so the question reaches companies further down the chain. Whether this also applies to your company depends on who your customers are and what they ask you to provide; you would do best to ask the customer directly or check this with a few questions that will quickly give you insight.
Why the questions are becoming more detailed
The European NIS2 Directive describes ten categories of measures that organisations subject to the Directive must work on, such as risk management, access control and incident handling. Buyers who must themselves account for these measures can only do so if they also know how their suppliers deal with them. This explains why questionnaires that previously asked one broad question now ask a separate question per category, often with a request to send brief evidence.
This shift from general questions to specific questions per measure is not a one-time adjustment. Buyers adapt their own portal and format as they themselves gain more clarity on what is expected of them. As a supplier, this means that the same customer may send a slightly different questionnaire the following year, even if nothing has changed on your side.
Who this affects this year
The Directive itself targets organisations in specific sectors and above a certain size. Whether a company falls under it is described in the Directive and the national law that implements it; this is something to verify with a lawyer or the regulator, not something that can be determined from a questionnaire alone. What is noticeable in practice is that companies that are not themselves subject to the Directive also receive questions passed on because their customer must comply.
This cascade effect is the most important practical change this year. An installation company that maintains software for an energy supplier, or an IT service provider working for a hospital, may receive a more detailed questionnaire without the company itself being subject to the Directive. The background of the ten measures and what they precisely mean is detailed in the knowledge bank with explanations by topic.
What is still uncertain
The Directive was originally supposed to be transposed into national legislation of the Member States by October 2024. In the Netherlands, this legislative process is still ongoing, and the precise form and the moment when the national law will come into full effect were not definitively determined at the time of writing. This means that the exact obligations for organisations subject to the law, and the deadlines associated with them, may still change. For the current status, the text of the Directive itself and information from the regulator are the appropriate sources, not a questionnaire or a news article.
How to manage this without starting from scratch every year
Since the questions can shift somewhat per customer and per year, it helps to record the underlying information properly once and use it as the basis for completing each new questionnaire. This prevents you from starting from scratch with every new questionnaire, even if the questions are formulated slightly differently than last year. How this works in practice is described on the page where the information comes from.
If you have doubts about whether a specific question in a questionnaire applies to your company or not, that is something to discuss with the customer themselves or with an adviser. An overview of frequently asked questions about these types of questionnaires can be found on the page frequently asked questions about questionnaires.
Finally
The core of the change this year is not that a new obligation is created, but that existing obligations work further through the supply chain and are asked for more concretely. If you want to quickly know where your company stands at the moment, take the free quick-scan or read the other topics in the knowledge base.