should we ask the same cybersecurity questions to our own suppliers

Yes, because Article 21(2) requires it explicitly

Yes, in most cases you must. Article 21(2) of the NIS2 Directive lists ten measures that an entity must take, and point (d) specifically concerns the security of the supply chain — including the relationship with and between each supplier or service provider. If your customer asks about supply chain security, it is therefore not enough to show what you do yourself. You must also be able to demonstrate what you require from your own subcontractors and how you monitor it.

In practice this usually means a layered approach, not a copy of your customer's entire questionnaire. For your part, usually ask: does the subcontractor have basic measures in place (access, backups, incident handling), is there a contractual provision on the obligation to report an incident, and — for critical suppliers — is there evidence such as an ISO 27001 certificate or their own declaration. The more critical the subcontractor is to your service delivery to the customer, the more specific the requirements you can pass on. This is the same question your customer is now asking you about security requirements for own suppliers — you are in the middle of the chain, not at the beginning.

Where that appears in the directive and the standard

The obligation itself is set out in Article 21(2)(d) of the NIS2 Directive, which lists supply chain security as one of the ten mandatory measures. For Dutch practice, this translates into the Cybersecurity Act, the transposition of NIS2 that enters into force on 15 August 2026 — from that date the obligation also formally applies under Dutch law to entities falling under the Act. Those who can demonstrate that this has been systematically organised often refer to Annex A of ISO/IEC 27001, where supplier relationships and security in the supply chain are included as separate control measures. Whether your organisation itself falls under the NIS2 Directive as an entity is, however, a separate question that is independent of what your customer contractually requires of you; that distinction is addressed in the question of whether the organisation falls under the Directive.