Discuss your project

TOOLBOX · DOWNLOAD

Assessing thesupply chainsecurely.

Supply chain security is one of the minimum measures under § 32 NISG 2026 (Austrian Network and Information Systems Security Act 2026), and Implementing Regulation (EU) 2024/2690 describes in detail what entities must regulate when selecting their suppliers, in the contract and in ongoing reviews. This template turns that into a questionnaire you can send to IT service providers, software vendors and suppliers: with questions on organization, technology, incidents and contract termination, a classification of suppliers by criticality, a register to fill in and the eight contract points of the Implementing Regulation. It uses ENISA’s implementation guidance of June 2025.

Download PDF (8 pages)What Is Inside

Free PDF · Template

Supplier Security Questionnaire: Template for NIS2 and the Supply Chain

Topic
NIS2 & Compliance
Format
PDF, A4
Length
8 pages
Size
105 KB
Updated
Oct 25, 2026
Sources
7
Usage
Adaptation for your own use permitted; redistribute unchanged
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

Questions on organization, technology, incidents and contract termination, with classification, supplier register and contract points under Implementing Regulation (EU) 2024/2690.

  • Procurement and contract management who select IT service providers and suppliers
  • Information security officers of essential and important entities
  • Management responsible for the risk management measures
  • Suppliers who answer such questionnaires and want to prepare

7 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What the NISG 2026 and the Implementing Regulation require

    The supply chain as a mandatory measure and the details of the Implementing Regulation

  • 02

    Classifying and recording suppliers

    Scope of review by supplier criticality, register under IR point 5.2

  • 03

    Questionnaire part 1: organization and evidence

    Who is responsible at the supplier and what they can prove

  • 04

    Questionnaire part 2: technology and operations

    Access, vulnerabilities, development, data and resilience

  • 05

    Questionnaire part 3: incidents, audits, contract termination

    What applies in an emergency and how the collaboration ends

  • 06

    Evaluating and following up on answers

    From the completed questionnaire to a documented decision

  • 07

    Contract points under IR Annex point 5.1.4

    What contracts with suppliers should specify where appropriate

EXCERPT

Questionnaire part 1: organization and evidence

Questionnaire from [company] to [supplier], completed by [name, function] on [MM/DD/YYYY]. Please answer every question and provide evidence, such as a document, certificate or audit report.

Part 1: Organization
No.QuestionAnswerEvidence
1.1Who is responsible for information security at your company (name, function, contact)?____________________
1.2Do you have a documented security policy or management system? Which certifications do you hold, with what scope and valid until when?____________________
1.3Are you yourself an essential or important entity under NIS2, or do your products fall under the Cyber Resilience Act?____________________
1.4Who owns your company, and which jurisdiction are you subject to?____________________
1.5Have you had security incidents affecting customers in the last three years? What did you change as a result?____________________
1.6How do you train your employees in security, and what qualifications do the people working for us have?____________________
1.7Do you screen the employees who have access to our systems or data?____________________
1.8Do you use subcontractors? Which ones, where, and do the same security requirements apply to them?____________________

Basis: selection criteria and certifications, training and background checks, subcontractors (IR Annex points 5.1.2 and 5.1.4(b), (c), (g)); ENISA lists jurisdiction, ownership, incident history and regulation under NIS2 or the Cyber Resilience Act as criteria.

Get the Full PDF

SOURCES

Supported
by Sources.

  1. NISG 2026, BGBl. I No. 94/2025, version in force in the RIS (opens in a new tab)§ 32 para. 4 lit. c, d, h, j and § 33 para. 1, accessed October 25, 2026
  2. Directive (EU) 2022/2555 (NIS2 Directive), German version on EUR-Lex (opens in a new tab)Art. 21(2)(d) and (3), accessed October 25, 2026
  3. Implementing Regulation (EU) 2024/2690, German version on EUR-Lex (opens in a new tab)Annex points 5.1, 5.2, 6.1.2 and 6.7.2, accessed October 25, 2026
  4. NISV 2026, BGBl. II No. 290/2026 (opens in a new tab)§ 2 applicability of the IR, § 3 risk categories, accessed October 25, 2026
  5. GDPR, German version on EUR-Lex (opens in a new tab)Art. 28(3), accessed October 25, 2026
  6. ENISA: Technical Implementation Guidance, Version 1.0 (June 2025) (opens in a new tab)Chapter 5 Supply Chain Security, accessed October 25, 2026
  7. ENISA: Good Practices for Supply Chain Cybersecurity (June 2023) (opens in a new tab)Executive Summary and Section 2.1, accessed October 25, 2026

This template must be adapted to your entity, your suppliers and your risks and does not replace legal advice. The questions and the classification are TOMORIS recommendations. The NISG 2026, the NISV 2026 and Implementing Regulation (EU) 2024/2690 as currently in force are authoritative; for data processing agreements (DPAs), also Art. 28 GDPR.

TOOLBOX

Explore
Further.

NIS2 & COMPLIANCE

More on
This Topic.

More free PDFs about NIS2 & Compliance.
All NIS2 & Compliance Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads