customer asks how we are protected against attacks via our suppliers

This question concerns article 21(2)(d), not your entire security policy

This question specifically addresses supply chain security: what do you do to prevent a vulnerability at your supplier from enabling an attack on you. This is one of the ten measures in article 21(2) NIS2, alongside risk analysis, incident handling and cryptography, among others. The questioner therefore does not want to know how your own systems are secured — that is a different question in the list — but how you maintain control over risks that come in through a third party.

Concrete evidence for this typically consists of three elements: a supplier assessment before a contract is concluded, security requirements that are contractually established (think of a data processing agreement or a separate security annex), and an overview of which suppliers have access to which systems or data. If you do not have that, then "no" is the honest answer — a supplier list without underlying requirements is not evidence of control. If you want to look deeper into what the client specifically means by this question, it helps to see whether the undertaking sets security requirements for its own suppliers is worked out separately in the chain dossier, apart from the question of whether you yourself fall under the directive.

If you are ISO 27001 certified, the answer is often already ready: Annex A contains a specific control measure for supplier relationships (A.5.19 to A.5.22 in the 2022 version), and an auditor has already checked that. Without certification, the answer is not automatically "no" — it is about what you actually do, not about the stamp. If in doubt, check whether the undertaking is ISO 27001 certified is already recorded in the dossier, which saves investigation work on this question.

Where this comes from: article 21(2)(d) NIS2

Article 21(2)(d) of Directive (EU) 2022/2555 explicitly mentions "supply chain security" as a mandatory part of risk management, including the relationship with individual suppliers. The Cyber Security Act incorporates this obligation as soon as that act enters into force; until that date, the question may already occur because the client themselves already falls under the directive and passes this on in the chain, even if you yourself are not a NIS2 entity.