CYBCybersecurity

NIS2 and suppliers: what customers ask in questionnaires, and how to prepare

Companies subject to NIS2 must assess and check the suppliers that touch their systems. For suppliers, it all arrives as questionnaires and contract clauses. Here is what customers ask, and how to prepare answers that stand up.

Strategic editorial team 17 September 2026 8 min read

Cover: “NIS2 and suppliers: answering the questionnaires”, Cybersecurity

A supplier does not fall under NIS2, the EU directive on network and information security, just because its customer does. It still feels the effects. Companies subject to Legislative Decree 138/2024 (Italy’s NIS2 law) must assess the risk that each supply brings to their systems. They must set security requirements, write them into tenders and contracts, and check regularly that they are met. For suppliers, all this arrives as a questionnaire, a new clause or a request for documents. Preparing means writing down, once and with evidence, how your company protects access, data and services. Then you keep that documentation up to date.

Why are the questionnaires arriving now?

Because the deadlines for the baseline security measures are falling due. Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) set those measures in Determination 379907 of 19 December 2025. Organisations added to the list of NIS entities in 2025 must adopt them within eighteen months of being notified of their inclusion. For many, the ACN says, that means by October 2026. Organisations added to the list for the first time in 2026 have until 31 July 2027.

One group of those measures concerns the supply chain. The decree lists it among the minimum elements of risk management (Article 24). It requires entities to consider the vulnerabilities of each direct supplier and the quality of its security practices, including its procedures for developing software securely.

One detail explains the timing. According to the ACN’s frequently asked questions, existing contracts do not necessarily have to be amended. Security requirements are, however, mandatory in contracts signed, renewed or extended after the deadline, unless there are justified and documented reasons. So the requests arrive mainly with renewals and new tenders.

What does the customer assess before writing the questions?

The baseline measures list five criteria for assessing the risk of a supply. Knowing them helps explain why a software house receives a long questionnaire and a cleaning company usually a short one. The ACN makes clear that requirements should be tailored to the nature of the service and to the actual risk.

Customer’s criterion	What it means for the supplier	What it helps to have ready
Level of access to systems	Remote access, admin accounts, integrations	A list of access rights and the rules for granting and revoking them
Access to data and intellectual property	Which data is seen, copied or stored	A map of the data processed, storage locations, encryption
Impact of a serious disruption	What happens to the customer if the service stops	A business continuity plan and alternatives
Recovery time and cost	How long it takes to get back up and running	Data backups and documented restore tests
Role in running the systems	Whether the supplier administers the customer’s systems	Procedures, authorised people, activity logs

Which questions come up most often?

Every customer writes its own questionnaire, but the requirements it sets must be consistent with the measures it applies to its own systems. That is why the questions tend to follow the ACN baseline measures. These are the recurring blocks.

Organisation. Who is responsible for security, who is the contact for the customer, and how to reach them in an incident.
Access. Individual accounts that are not shared. Multi-factor authentication, meaning the password plus a second element such as a code on a phone. Admin accounts kept separate from everyday ones. Access revoked when someone leaves the company.
Data and backups. Where the customer’s data is kept, who sees it, how backups are made and when a restore was last tested.
Updates and vulnerabilities. How security updates are installed and how quickly, and how reported weaknesses are handled.
Incidents. How soon the supplier warns the customer of an event that affects its services. The ACN states that a customer that is a NIS entity must make sure its supplier reports such events promptly.
Subcontractors. Who else along the chain has access to systems or data, such as cloud services, outside support and consultants.
People. Security training, and the criteria for assigning roles with high privileges.
Assessments. The date and scope of the last technical assessment, the status of the fixes and openness to checks by the customer.

How do you answer without promising what isn’t there?

A “yes” written in a questionnaire easily becomes a contractual commitment. That is why the strongest answers come in three kinds. “Yes” comes with the document that proves it. “Partly” comes with a note of what is missing. “Not yet” comes with a plan and a date. A serious customer prefers a credible plan to a ticked box.

Some practical rules help.

One person coordinates the answers and gathers input from IT, finance and legal, so that two customers do not receive different versions.
“Not applicable” needs a reason. If the service does not touch the customer’s systems, say so and explain why.
Reporting deadlines can be negotiated. Only accept a commitment to report within a few hours if your organisation can meet it on public holidays too.
Sensitive details should not be attached lightly. Full network diagrams and technical assessment reports are shared under a non-disclosure agreement (NDA), often as a summary.

What goes into the supplier pack?

A set of short documents, each dated and with an owner, ready to send.

A page on how security is organised, with roles and contacts.
The list of services provided and the systems that support them.
The access rules, including multi-factor authentication and the periodic review of user accounts.
The data backup procedure, with the log of restore tests.
The procedure for updates and vulnerabilities.
The incident procedure, including the step that alerts customers and the relevant contacts.
The list of subcontractors that access systems or data.
The training record.
A summary of the last technical assessment, with the status of the fixes. One example is a penetration test, meaning a simulated and authorised attack.
A summary of the business continuity plan.

The pack is only worth something if it describes what really happens. A well-written document that is never applied is found out at the first check. The Observatory has published a guide to how much a penetration test costs, covering what drives the price of a technical assessment.

Where do you start if the questionnaire has already arrived?

A typical scenario. An IT services company with a few dozen employees receives a file with dozens of questions from a customer in the energy sector, with a two-week deadline. This is the sequence that works.

Clarify the scope with the customer. Ask which services and which systems the questionnaire covers.
Sort the questions into three groups. Some already have a documented answer, some have an answer that was never written down, and some reveal a gap.
Close the quick gaps straight away, such as multi-factor authentication on remote access or a review of user accounts.
Answer with dates for whatever takes longer, and keep to them.
Reuse the work. The pack created for one customer serves the next ones too.

It also helps to know what happens if an incident hits the customer’s systems. According to the ACN, notifying CSIRT Italia, Italy’s national computer security incident response team, is the duty of the customer that is a NIS entity. The customer may involve the supplier in handling the incident. If the supplier is itself a NIS entity and the incident hits its own systems with effects on the customer, both may have to notify. Management’s decisions in those hours are covered in our article on who decides, who communicates and what to preserve.

What about San Marino? The obligations described here fall on customers subject to Italian law, so a San Marino supplier receives the same requests as an Italian one. Beyond that, the framework is different and has to be assessed case by case.

In brief

The supplier of a company subject to NIS2 does not fall under it for that reason. But it does receive questionnaires, clauses and requests for evidence.
For many companies added to the list in 2025, the ACN baseline measures fall due in October 2026. Supplier requirements go into new, renewed or extended contracts.
The customer assesses access to systems, access to data, the impact of a disruption, recovery times and the supplier’s role.
The best answers can be checked. “Yes” comes with a document, “partly” with what is missing, “not yet” with a date.
A short, up-to-date supplier pack saves you starting from scratch with every questionnaire.

Frequently asked questions

Does a supplier to a company subject to NIS2 automatically fall under NIS2?

No. It falls under the law directly only if it carries out one of the activities listed in the decree and meets the criteria, as can happen with some managed IT services. Check this with your own lawyers. In other cases, it receives contractual requests from the customer.

Can the customer ask to change a contract that has already been signed?

It can ask, but the baseline measures do not oblige it to do so. According to the ACN, security requirements are mandatory for contracts signed, renewed or extended after the deadline set for the customer. Many customers introduce them at the first renewal.

Do the answers need to repeat the wording of the ACN measures?

No. The ACN states that the requirements written into contracts need not reproduce the baseline measures word for word. They should reflect their substance, in proportion to the risk of the supply. Answers also work better in your own words, with references to real documents.

Who in the company should fill in the questionnaire?

One person should coordinate, usually the head of IT or of security. Finance and legal contribute on the contractual parts. The final signature belongs to someone who can commit the company.

Strategic’s Cybersecurity division helps companies subject to NIS2, and their suppliers, put the supplier pack in order, close the gaps the questionnaire has revealed and test their systems before the customer asks.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.