NIS2 supplier questionnaires: what Dutch SMEs are being asked, and how to answer

Key facts

The Dutch Cyberbeveiligingswet (Cbw), which implements NIS2, entered into force on 15 August 2026 with no general transition period (Houthoff).
The EU deadline to transpose NIS2 was 17 October 2024; the Netherlands was almost two years late (Eversheds Sutherland).
Around 8,000 Dutch organisations are in scope, many never regulated for cyber security before (Holm Security).
Supply-chain security is one of the ten minimum measures in Article 21 of the directive, which is why your customers are asking you (Directive (EU) 2022/2555).

NIS2 is the EU's second Network and Information Security Directive. It makes medium and large organisations in eighteen sectors responsible for managing cyber risk, including the risk that comes through their suppliers. In the Netherlands it became law as the Cyberbeveiligingswet (Cbw) on 15 August 2026. If your company sells to an in-scope organisation, you are not regulated yourself, but you are now part of their risk register. The questionnaire in your inbox is how they document that.

Why a supplier questionnaire lands on your desk

Article 21 of the directive lists the minimum measures an in-scope entity must take. Point (d) is supply-chain security, "including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers". An entity cannot show it manages supplier risk without asking suppliers about their security. So procurement sends a questionnaire, usually once at onboarding and again every year or two.

The questionnaire is not a test you pass or fail. It is a request for evidence. The difference matters: an answer like "we take security seriously" scores zero, while "DMARC is at p=reject since March, here is the DNS record" scores full marks even if the rest of your posture is average.

What the questions actually cover

Questionnaires differ in length, but they map onto the same themes. The table shows the theme, the question you will typically see, and what counts as evidence.

NIS2 theme	Typical question	Evidence that answers it
Risk management	Do you have a documented risk assessment and a plan to treat the findings?	A dated attack-surface report and a remediation plan ordered by risk
Incident handling	Who do we contact during an incident, and how fast will you notify us?	A named incident contact, a one-page runbook, and a notification promise in writing
Supply chain	Which sub-processors handle our data, and where?	A sub-processor list with locations and transfer basis
Access control	Is multi-factor authentication enforced? Who has admin access?	Screenshots or exports of MFA enforcement and an admin list, reviewed quarterly
Encryption	Is data encrypted in transit and at rest? Are backups encrypted?	TLS configuration results and the platform's encryption statement
Email authentication	Are SPF, DKIM and DMARC enforced on your sending domains?	The DNS records themselves and a DMARC policy of quarantine or reject
Training	Do staff receive security awareness training? When was the last phishing test?	A date, a result, and the briefing slides

How to answer in ten working days

1. Run the external checks first

Before you open the questionnaire, find out what the internet can see: DNS and nameserver configuration, TLS on every public host, HTTP security headers, open ports and admin panels, and the state of SPF, DKIM and DMARC. This takes a day and produces the single most useful document you own: a list of exposed things, each with a severity. Most questionnaires can be half answered from it.

2. Fix email authentication the same week

Email is the one control every questionnaire asks about and the one most SMEs fail. The fix is well understood: publish SPF listing only the services that actually send for you, enable DKIM signing on each of them, then move DMARC from p=none to p=quarantine and finally p=reject once the reports show every legitimate sender aligned. We did exactly this on our own domain and published the result on the security page.

3. Review access with a credential, not a screenshot

Admin panels, cloud consoles, hosting accounts, the CRM. For each: who has access, is MFA enforced, when were keys last rotated. Remove what is not needed. The questionnaire wants the review to have happened, not a promise that it will.

4. Write the incident page

One page: who to call, how fast you notify, what you log, where backups are and how long restoring takes. If you have never tested a restore, do it now and write down the time it took.

5. Map the evidence to the themes

Answer the questionnaire with references to documents, not prose. "See attachment 3, section 2" is a better answer than three paragraphs. A customer's security officer reads dozens of these; the ones with evidence pack numbers go to the top of the pile.

What not to do

Do not claim certifications you do not hold. "ISO 27001 aligned" without a certificate is a red flag to anyone who reads these for a living.
Do not answer "yes" to a control you plan to implement. Write "planned, target date", which is honest and still scores.
Do not send the questionnaire to your IT supplier to fill in alone. They will answer for their platform, not for your company.

Where ITovio fits

ITovio's NIS2 supplier-readiness assessment is built around exactly this sequence: external reconnaissance, authenticated review, email and domain authentication, a remediation sprint, and an evidence pack mapped to the themes above, in ten working days. We do not issue certifications and never claim compliance on a client's behalf; we give you evidence and a plan. If you want to see what the external checks find before talking to anyone, the free attack-surface check returns a short PDF within one business day.