questionnaire asks how we monitor the security of our suppliers

Supply chain security: your customer asks about your own suppliers

This question concerns Article 21(2)(d) of NIS2: security of the supply chain, including the relationship with each direct supplier or service provider. Your customer wants to know not only how you are secured yourself, but also how you enforce this with your subcontractors. In practice, the question usually asks whether you include security requirements in contracts, whether you assess suppliers in advance, and whether you periodically check that they comply with those requirements.

If you have not yet formally structured this process, the most honest answer is that you do it informally — for example through contractual clauses without structured assessment — or that you do not yet do it. Ticking "yes" because it sounds logical does not help: if your customer asks further for a sample contract or a supplier list with risk score, that must also be there. The same question often comes back in a slightly different form, namely whether the undertaking sets security requirements for its own suppliers — that is essentially the same requirement, but separated from the contract question. It is therefore worthwhile to formulate one answer that you can reuse on multiple lists.

Where this comes from: Article 21(2) and Annex A.5.19-21

The legal basis is Article 21(2)(d) of the NIS2 Directive, one of the ten mandatory measures mentioned there. For Dutch practice, this appears again in the Cyber Security Act, the transposition of NIS2 that enters into force on 15 August 2026 — your customer's question often runs ahead of what becomes mandatory for you only later, unless you already fall under the directive through the definition of entity under NIS2. Those who apply ISO/IEC 27001 recognize the same requirement in Annex A, the control measures under A.5.19 through A.5.21 on supplier relationships and the security requirements set out therein. Both sources ask essentially the same thing: not only know who your suppliers are, but demonstrably monitor their security level.