How to Answer Customer Security Questionnaires From Your NIS2 Documentation — Without Promising More Than You Do

Answer every customer security questionnaire from one internal answer library keyed to the CIR 2024/2690 Annex, not from the customer’s spreadsheet. Each answer should name the document that proves it, state exactly which service it covers, and promise nothing your written procedures don’t already deliver, because the answers you give in procurement tend to come back as contract clauses.

The requests won’t slow down. ENISA’s NIS Investments 2025 survey found that 90% of organisations in NIS sectors run specific supply-chain controls. The most common is “requiring suppliers to comply with security standards and maintain certifications (63%)”, followed by supplier risk assessments or audits (54%) and security requirements in supplier contracts (48%). If you sell into NIS2 sectors, those percentages arrive as questionnaires.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Why the Questionnaire Arrives and What It Tests

In plain terms: your customer is legally obliged to assess you; you usually aren’t obliged to answer in any set format. What they must assess tells you which answers carry weight.

Article 21(2)(d) of NIS2 requires essential and important entities to cover “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. Article 21(3) of the NIS2 Directive adds that they must take into account “the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures.”

For eleven digital entity types (cloud, data centre, managed service and managed security service providers among them), Commission Implementing Regulation (EU) 2024/2690 spells this out. Its Annex point 5.1.2 says supplier selection criteria “shall include” (a) your cybersecurity practices, including secure development procedures, (b) your ability to meet cybersecurity specifications the customer sets, (c) the overall quality and resilience of the specific ICT product or service, and (d) the customer’s ability to diversify supply and limit lock-in, “where applicable”. Only (d) has a qualifier. Outside those eleven types it doesn’t bind directly, but it’s the most detailed EU text on supplier assessment, so it’s the safest structure to answer against.

Your position	Do you have to answer?	What the questionnaire is testing	Answer from
Supplier outside NIS2 scope	No NIS2 duty; it’s a commercial requirement	Whether your customer can meet its own Article 21(3) duty by relying on you	Whatever security documentation you hold, indexed to the Annex so gaps are visible
Essential or important entity that also supplies others	Still contractual, but your own Article 21 measures already exist	The same, plus how you manage your own suppliers (your customer’s fourth parties)	Your Article 21(2) policy set
One of the 11 CIR entity types	Contractual, and the Annex binds you directly	The same, and your answers can be compared with your own Annex obligations	Your CIR compliance matrix, chapter by chapter

However long the questionnaire is, three questions sit underneath it: is your security practice sound (5.1.2(a)), can you meet this customer’s specification (5.1.2(b)), and is this particular service resilient (5.1.2(c))? Spend your effort there. (How buyers choose between questionnaire, document review and audit is covered in tiered supplier due diligence.)

Build One Answer Library Keyed to the CIR Annex

In plain terms: map each recurring question family once, to an Annex point and to the document that proves it. After that, every new questionnaire is a matching job, not a writing job.

The UK’s NCSC, writing for buyers in its post on supplier assurance, admits the problem from the other side: “Often, suppliers will be asked about the same areas of security in slightly different ways by different organisations.” Shared Assessments’ SIG (over 850 questions in its Core version, around 125 in SIG Lite), the Cloud Security Alliance’s CAIQ, the NCSC’s own ten-heading question set and every bank’s in-house spreadsheet cover the same subjects in different words. The CIR Annex’s thirteen chapters cover the same ground without any vendor’s format, which makes them a neutral key.

When we built the supplier self-assessment questionnaire in our own toolkit, the Annex gave us criteria, not questions; every question had to be derived from a requirement. Answering works in reverse: start from the requirement, then point to the document.

Question family (as customers phrase it)	CIR Annex point	Document that answers it	Evidence you can usually share
“Is there a management-approved security policy?”	1.1, 1.2	Information security policy, roles and responsibilities	Approval date and table of contents
“How do you assess and treat risk?”	2.1	Risk methodology, risk treatment plan	Methodology summary, never the register
“What is your incident response process?”	3.1–3.6	Incident handling policy	Process outline and notification contact
“Do you have tested BC/DR plans?”	4.1, 4.2	Continuity plan, backup policy	Date and result of the last test
“How do you manage subcontractors?”	5.1, 5.2	Supplier security policy, supplier directory	Subcontractors used for this service
“Secure development, testing, patching?”	6.2, 6.5, 6.6, 6.10	Secure development, testing, patch and vulnerability procedures	Redacted test summary
“Training and background checks?”	8.1, 8.2, 10.2	Training plan, HR security policy	Completion rate, check types (not results)
“Encryption at rest and in transit?”	9	Cryptography policy	Algorithm and key-management summary
“MFA and privileged access?”	11.3, 11.6, 11.7	Access control and authentication policies	Policy extract

Give each entry seven fields: question family, one-line answer, short paragraph answer, scope (service, legal entity, locations), source document and version, evidence tier, and owner with review date. If you’re ISO 27001 certified, your Statement of Applicability already indexes control by control; add a CIR column next to Annex A and the library has its spine.

Five Answer Types and the Honest Wording for Each

In plain terms: “yes” and “no” are rarely the most accurate answers. Use five answer types, each with a fixed shape, so reviewers can tell an honest limit from an evasion.

Answer type	Use when	Shape	Example
Yes	The control exists, is written down and covers this service	Yes + document + last review	“Yes. Access Control Policy v2.1, reviewed March 2026, applies to all production systems for this service.”
Yes, scoped	The control exists, but not everywhere	Yes + explicit boundary	“Yes for the hosted platform. Our internal support desk is outside this scope.”
Partial, dated	A known gap is being closed	What exists + what’s missing + date + owner	“MFA is enforced on all admin accounts; rollout to all staff accounts completes by 31 March 2027 (owner: IT lead).”
No, compensated	The control is absent by design	No + reason + what reduces the risk	“No dedicated SOC. Alerts from our hosting provider’s monitoring go to an on-call engineer, 24/7.”
Not applicable, reasoned	The requirement doesn’t fit the service	N/A + one-sentence reason	“N/A. We develop no software; this contract covers hardware maintenance only.”

The last two types mirror how the CIR treats discretion. Its Article 2(2) lets a covered entity set aside a requirement marked “where appropriate”, “where applicable” or “to the extent feasible” only if it “shall in a comprehensible manner document its reasoning to that effect”. A bare “N/A” fails the same test in a questionnaire, because the reviewer can’t tell an honest exclusion from a skipped row.

Suppliers dread the partial answer, but it’s often the strongest one. NIS2 Article 21(4) expects an entity that finds a gap to take corrective measures “without undue delay”, and a dated remediation commitment shows the same discipline. A partial answer gives the reviewer something to record and follow up; an inflated yes gives them something to discover later.

Watch for questions that slip in a standard NIS2 doesn’t set. “Do you run annual penetration tests?” is the classic. CIR Annex 6.5.2(a) has covered entities set “the need, scope, frequency and type of security tests” from their own risk assessment, and it fixes no annual cycle. If your cadence is different, give your actual cadence and the reason for it, not a yes you’ll later be audited against.

Every Answer Is a Future Contract Clause

In plain terms: what you write in procurement tends to reappear in the security schedule. Treat each answer as a commitment your legal team has seen.

CIR Annex 5.1.4 has covered customers write supplier contracts that specify, where appropriate, eight things, “taking into account the results of the risk assessment”. Most questionnaires ask about each of the eight first. Your answer is the input to the clause you’ll be asked to sign.

If they ask about	Likely clause (CIR 5.1.4)	Check before you answer
Staff training or certifications	(b) awareness, skills, training, certifications	Can you evidence it for everyone on the account?
Background checks	(c) verification of staff background	What does local employment law let you verify?
Incident notification time	(d) notify “without undue delay”	The Annex sets no hour figure for suppliers. Any number you give must match your incident procedure.
Audits	(e) “the right to audit or right to receive audit reports”	Offering audit reports can stand in for on-site audits; say which reports exist.
Vulnerability handling	(f) handle vulnerabilities that put the customer at risk	Do stated patch times match your procedure?
Subcontractors	(g) subcontracting requirements	Can you flow the requirements down?
Data at contract end	(h) retrieval and disposal of information	Do you have a written return-and-deletion procedure?

For legal and compliance teams: review the notification, audit and subcontracting answers before the questionnaire goes out, not after the draft contract arrives. In practice, buyers often attach or quote questionnaire responses in the contract, so a number given casually in March can be a contractual obligation by June. The supplier’s guide to the Article 21(2)(d) contract cascade covers the clauses themselves, and the due-diligence standard your customer applies explains how much scrutiny they owe you.

Evidence: Describe It, Share It Under NDA, or Show It Only

In plain terms: not every answer needs an attachment, and some documents should never leave your building.

Evidence tier	Typical items	Rule
Public	Certificates with scope, a CAIQ published to the CSA STAR registry, trust-page summaries	Must be consistent with every private answer you give
Under NDA	Policy tables of contents or extracts, redacted test summaries, continuity test results, subcontractor list	Send the extract, not the whole document
Show only	Risk register, full penetration test report, incident log, network diagrams	Screen-share or on-site review; nothing left behind

Careful with the public tier: the Cloud Security Alliance’s STAR registry is publicly accessible, and a Level 1 entry is a CAIQ with “a set of Yes/No/NA questions and space to justify the response”. Any customer can compare it with what you told them privately.

Certificates are the most-requested proof (that 63% figure again), but a certificate proves a scope, not a company. Quote the scope next to it. An ISO 27001 certificate is strong evidence for your practices under 5.1.2(a); it says nothing about whether you can meet this customer’s own specification under 5.1.2(b). Our guide to NIS2 evidence collection covers which formats hold up for which requirement.

Expect component questions too. CIR Annex 6.1.2(c) puts “information describing the hardware and software components used in the ICT services or ICT products” into covered customers’ acquisition processes. Decide in advance what component list you’ll provide, and in what format.

A Seven-Step Response Workflow, With Owners and Effort

Step	What happens	Owner	Effort
1. Intake	Log the customer, service, deadline and questionnaire format	Account owner	Low
2. Scope	Fix which systems, sites and subcontractors deliver this service	CISO or IT lead	Low
3. Match	Map each question to a library family	Compliance	Medium first time, Low after
4. Fill gaps	Draft answers for unmatched questions and add them to the library	CISO with document owner	Medium
5. Legal review	Check every answer that maps to a 5.1.4 clause	Legal	Low to Medium
6. Sign-off	A named person approves the response	Management or owner	Low
7. Archive	Store the submitted version, date and evidence sent	Compliance	Low

For SME owners without a security team: steps 2 to 4 fall to you or your IT lead. Start the library with the rows your three largest customers asked about, not the full Annex. ENISA’s same survey found 63% of the SMEs it questioned had run no cybersecurity assessment in the previous year, so a short, honest library already puts you ahead of many peers.

For CISOs: step 2 is where most errors start. A questionnaire answered for “the company” when the customer buys one service mixes scopes. Answer for the service, and say so in the first line.

Keep the Library True: Five Review Triggers

The NCSC notes that questionnaire evidence “will represent a point in time.” CIR Annex 5.1.6 also has covered customers “monitor, evaluate and, where necessary, act upon changes in the cybersecurity practices of suppliers and service providers” at planned intervals and after significant changes or incidents, so expect repeat questionnaires. Review the affected library entries whenever:

1. A source policy gets a new version.
2. A significant incident affects the service.
3. A subcontractor is added, replaced or changes its own security posture.
4. A certificate is renewed, rescoped or lapses.
5. A remediation date from a partial answer passes. Update every customer who received that answer, whether or not they ask.

For each submitted response, record the customer, service, date, library version, evidence sent (with tier), approver, and any commitment that carried into the contract.

Frequently Asked Questions

Do we have to answer if we are not a NIS2 entity?

NIS2 puts no duty on an out-of-scope supplier to answer. The duty sits with your customer, who must assess its direct suppliers under Article 21(3). Refusing usually costs the contract, so the real question is how to answer accurately and fast.

Can we send our ISO 27001 certificate instead of answering?

For some sections, often yes. It won’t answer questions about this customer’s specifications or the specific service’s resilience, and it covers only the certified scope. Send it with the scope statement and answer the remaining rows.

Can we refuse to share our risk register?

You can decline to send it and offer a screen-share or on-site review instead. CIR Annex 5.1.4(e) itself treats the right to receive audit reports as an alternative to the right to audit, so offering reports and supervised viewing is a recognised approach, not an evasion.

Sources

• European Parliament and Council. Directive (EU) 2022/2555 (NIS2 Directive), Article 21. EUR-Lex.
• European Commission. Commission Implementing Regulation (EU) 2024/2690, Articles 1–2 and Annex points 1–13 (in particular 5.1.2, 5.1.4, 5.1.6, 6.1.2, 6.5.2). EUR-Lex.
• ENISA. NIS Investments 2025 (main report, supply-chain and SME assessment findings).
• National Cyber Security Centre (UK). Supplier assurance: having confidence in your suppliers (blog post).
• National Cyber Security Centre (UK). Supplier assurance questions (guidance).
• Cloud Security Alliance. STAR Registry (CAIQ Level 1 self-assessments).
• Secureframe. What is the SIG questionnaire (SIG Core and SIG Lite structure; used for background only).