Supplier Security Questionnaire: Template for NIS2 and the Supply Chain

Essential and important entities must address supply chain security, including the relationships with their direct suppliers and service providers, taking into account their vulnerabilities, the quality of their products and their cybersecurity practices, including secure development (§ 32 para. 4 lit. d NISG 2026, Art. 21(2)(d) and (3) NIS2 Directive). ENISA points out that NIS2 only covers direct first-tier suppliers.

Which questions you ask and how you classify suppliers is a TOMORIS recommendation based on the Implementing Regulation and ENISA guidance. The contents of § 32 NISG 2026 and the Implementing Regulation are mandatory to the extent they apply to your entity. Processing personal data on behalf of a controller also requires a contract or other legal act under Art. 28(3) GDPR.

Not every supplier requires the same effort. Among other criteria, ENISA lists the sensitivity of the products and services procured, the supplier’s ability to ensure supply, its history of security incidents and the risk of dependency (lock-in). From this, TOMORIS derives three tiers:

Questionnaire from [company] to [supplier], completed by [name, function] on [MM/DD/YYYY]. Please answer every question and provide evidence, such as a document, certificate or audit report.

Basis: selection criteria and certifications, training and background checks, subcontractors (IR Annex points 5.1.2 and 5.1.4(b), (c), (g)); ENISA lists jurisdiction, ownership, incident history and regulation under NIS2 or the Cyber Resilience Act as criteria.

Basis: security requirements, updates throughout the lifetime, components and security functions on acquisition (IR Annex point 6.1.2), remediation of vulnerabilities (point 5.1.4(f)), remote access by service providers (point 6.7.2(d)), multifactor authentication, cryptography and business continuity (§ 32 para. 4 lit. j, h and c NISG 2026); ENISA recommends storage and processing locations as contract content.

Basis: incident reporting, audit rights and obligations at contract termination (IR Annex point 5.1.4(d), (e), (h)); ENISA lists support during incidents, notification of significant changes and exit as additional contract content.

1. 1

   Check plausibility

   Compare answers with the evidence; check certificates for scope and validity. Request missing answers.

2. 2

   Assess the risk

   Take the selection criteria into account in selection and contract award (IR point 5.1.5); where appropriate, carry out and record a risk analysis before concluding the contract (ENISA on 5.1.5).

3. 3

   Close gaps

   Address deviations through contract clauses, service level agreements or your own safeguards, such as restricted access. If that is not possible, consider alternatives.

4. 4

   Decide and document

   Record approval, conditions or rejection with reasons and the people responsible; enter the supplier in the register.

5. 5

   Monitor continuously

   Track performance reports, review incidents involving the supplier’s products, assess the need for unplanned reviews (IR Annex point 5.1.7), for example after incidents, significant changes or contract breaches (ENISA); according to ENISA, review the policy at least annually.

For the self-declaration to the cybersecurity authority, information on supply chain security in particular must be submitted (§ 33 para. 1 NISG 2026). Completed questionnaires, assessments and the register provide a good basis for this.

• a) Cybersecurity requirements for the supplier, including the requirements on acquisition under point 6.1.
• b) Requirements for awareness, skills and training and, where appropriate, certifications of the supplier’s employees.
• c) Requirements for background checks of the supplier’s employees.
• d) Obligation to report without undue delay security incidents that present a risk to your systems.
• e) Right to audit or to receive audit reports.
• f) Obligation to remediate vulnerabilities that present a risk to your systems.
• g) Rules on subcontracting; where permitted, security requirements for subcontractors.
• h) Obligations at contract termination, such as the return and disposal of information obtained.

For large suppliers whose contracts can hardly be negotiated, ENISA suggests alternatives: joint procurement with similar organizations, representation through an industry association, suppliers with published security commitments or recognized certifications, model contracts from public bodies and a short list of alternatives.