NIS2 supplier readiness checklist: twelve things your customers will ask a Dutch SME for

If you sell software, services, parts or people to a Dutch company in one of the NIS2 sectors, a security questionnaire is on its way, if it has not already arrived. The company sending it is not being difficult. Article 21 of the directive makes it responsible for the security of its supply chain, and the only way to show that is to ask each supplier for evidence. This checklist is the set of twelve items that appears, in one wording or another, in nearly every questionnaire we have seen, with what counts as evidence for each one.

How to read a supplier questionnaire

Treat every question as a request for an artefact, not an opinion. A procurement officer scores "Do you enforce multi-factor authentication?" by looking for a screenshot of the policy, a line in an onboarding document, or an export from the identity provider. The word "yes" on its own is worth nothing, and a confident yes that later turns out to be false can end the relationship. Where you do not have the artefact yet, say so, give a date, and name an owner. Honest gaps with a plan score better than vague completeness.

The twelve items

1. An inventory of what you run

The question: which systems, devices and cloud services process the customer's data? The evidence: a list, with an owner per item and a date it was last reviewed. A spreadsheet is fine. What it signals is that somebody knows what exists, which is the precondition for every other control.

2. Email authentication

The question: can someone send email pretending to be you? The evidence: published SPF, DKIM signing on every sending service, and a DMARC record with a reporting address and, ideally, a policy of quarantine or reject. This is the item we see missing most often, and it is the cheapest to fix, because it is three DNS records. It is also checkable from outside, so your customer may already know the answer before they ask.

3. Multi-factor authentication

The question: is a password alone enough to reach your email, your admin panels or the customer's data? The evidence: MFA enforced on the identity provider for all accounts, with a screenshot of the enforcement policy, and a note on which systems cannot support it and how they are protected instead.

4. Patching and updates

The question: how quickly do you apply security updates? The evidence: a written cadence (for example, critical patches within days, routine updates monthly), automatic updates turned on where possible, and a recent example. Server, laptop, phone and the website's content management system all count.

5. Backups and a restore test

The question: if you lost everything tonight, what would you have tomorrow? The evidence: what is backed up, where, how often, whether a copy is offline or immutable, and the date of the last successful restore test. The restore test is the part that separates a real backup from a hope. Run one and write the date down.

6. Access control and offboarding

The question: who can reach the customer's data, and what happens when someone leaves? The evidence: role-based access, a list of who has admin rights, and an offboarding checklist that removes accounts the same day. A former contractor's live login is a classic finding.

7. Logging and monitoring

The question: would you notice an intrusion? The evidence: logs retained for the systems that matter, somebody who reviews alerts, and a retention period. For a small company this can be the cloud provider's built-in audit log plus email alerts for sign-ins from new locations. It does not need a security operations centre.

8. Incident handling and reporting

The question: what do you do when something goes wrong, and how fast will the customer hear about it? The evidence: a one-page process with contact names, the decision of who declares an incident, and the commitment to inform affected customers within a stated time. NIS2 entities have tight reporting clocks of their own, so they need their suppliers to be fast.

9. Encryption and web security

The question: is data protected in transit and at rest, and is your website hardened? The evidence: HTTPS everywhere with HSTS, encrypted laptops and phones, encrypted storage at the cloud provider, and the standard security headers on your website. Like email authentication, most of this is visible from outside.

10. Your own suppliers

The question: who do you rely on, and have you asked them the same questions? The evidence: a list of sub-processors and critical vendors (hosting, email, CRM, payroll) with their location and a note on their security posture. The questionnaire you are answering will, in a smaller form, be the one you send them.

11. Staff awareness

The question: would your people recognise a phishing email? The evidence: a short training record, a phishing baseline test with the result, and a rule for reporting suspicious messages. A dated baseline matters more than a certificate from a course nobody remembers.

12. A security contact

The question: who do we call? The evidence: a named contact, a monitored address, and a published security.txt file on your website so researchers and customers find the right person without guessing.

What to fix first

Order the gaps by two things: how visible they are from outside, and how cheap they are to close. Email authentication, HTTPS and security headers, MFA and a security contact are visible and cheap, so they come first. A backup restore test is invisible but cheap and decisive, so it comes next. Inventory, logging and the incident process take longer and go into the dated plan you attach to the questionnaire. The order matters because a customer who checks your DNS and headers before reading your answers forms an opinion in the first minute.

Keeping the evidence current

Questionnaires come back every year or two, and a customer may ask again after an incident in the news. Keep the artefacts in one folder with a date on each, and put a quarterly check in the calendar: re-run the external checks, confirm MFA coverage, run a restore test. The second questionnaire then takes an afternoon instead of a month.

How ITovio helps

The NIS2 supplier-readiness assessment produces the artefacts in this list in ten working days: external reconnaissance, configuration review, email and domain authentication, cloud and hosting posture, a phishing baseline, and an evidence pack mapped to the NIS2 themes your customer is asking about. The free external attack-surface check covers the items that are visible from outside and is a reasonable place to start before any questionnaire arrives. Our own posture is published on the security page, gaps included, so you can see what we would hand a client about ourselves.

Questions this article answers

Do we have to comply with NIS2 if we only supply an in-scope company?

No. The Cyberbeveiligingswet regulates the in-scope entity, not its suppliers. The in-scope entity must manage supply-chain risk, which is why it asks you for evidence. Contracts can still make specific measures binding, so read the supplier terms.

What if we cannot answer yes to everything?

Answer honestly and attach a dated plan. Procurement teams expect gaps; what they cannot accept is a questionnaire that turns out to be wrong. An honest "planned for Q1, owner named" is a better answer than a yes you cannot prove.

How long does it take to get the twelve items in order?

Email authentication, MFA, a backup restore test and a security contact take days. Asset inventory, logging and a written incident process take a few weeks. A ten-working-day assessment produces the evidence pack and the ordered plan.

Does ITovio certify suppliers?

No. We produce evidence and a remediation plan mapped to the NIS2 themes. Certification, if a customer demands one, is a separate decision and a separate provider.

Related service: Cyber security for SMEs and scale-ups. Assessment, hardening and NIS2 supplier-readiness evidence, in ten working days.