we must demonstrate that we check our suppliers for cybersecurity, how do I do that

Supply chain security: what Article 21(2)(d) requires

Article 21(2)(d) of the NIS2 Directive lists supply chain security as one of the ten mandatory measures, including the security aspects of the relationships between the entity and its direct suppliers. In practical terms: you must be able to demonstrate that when entering into and maintaining supplier relationships, you assess whether that supplier poses a risk to your own service delivery. A documented supplier policy with at least three components typically covers this: a selection criterion in advance (what requirements do you set for new suppliers), a periodic review during the relationship term, and an escalation path if a supplier reports an incident. This is the same question your customer asks you about supply chain risk — you are essentially entering your own answer here, but one level deeper in the supply chain.

What counts as evidence depends on how mature your process is. A contract clause in which your supplier commits to certain security requirements is a starting point but not a review. Stronger is a questionnaire that you yourself send to suppliers, linked to a simple risk label (low/medium/high) based on what that supplier sees or touches of your systems. If you do not have that, then the most honest answer is that you still need to establish the process — not that you tick "yes" to a contract clause that does not apply. Note: this is a separate question from whether your own organization falls under the Directive; even if you are not directly subject to NIS2, a customer can still ask this of you via the supply chain obligation.

Where this comes from: Directive and Dutch law

The obligation is set out in Article 21(2)(d) of Directive (EU) 2022/2555; the Cybersecurity Act transposes this into Dutch law and is expected to enter into force on 15 August 2026. ISO/IEC 27001 Annex A contains a similar control measure on supplier relationships, which explains why customers with an ISO questionnaire often ask the same question as customers who refer to NIS2.