Your customer sent you a NIS2 questionnaire. Now what?

NIS2 requires organisations in scope to manage cybersecurity risks in their supply chain. In the Netherlands it applies through the Cyberbeveiligingswet, in force since 15 August 2026 and covering more than 8,000 organisations. That is why you receive a questionnaire, even if your own company is not in scope.

Why you get this questionnaire

An organisation under NIS2 must be able to show that it controls risks in its supply chain. The questionnaire is how it checks you. How you answer affects whether you stay, or become, a supplier.

What it usually covers

• Information security policy and who owns it
• Access management: who can reach which systems and data, and with what authentication
• Incidents: how you detect and resolve them, and how fast you inform the customer
• Backups and recovery after an outage
• Vulnerabilities and patching
• Your own suppliers, such as hosting or third-party software
• Staff awareness and training

How to approach it

1. Read what the customer actually asks. Note the deadline, whether evidence is required and whether you can add explanations.
2. Collect what you already have. Policies, procedures, certificates, earlier answers and contracts with your own suppliers.
3. Only answer what you can support. Point every answer to a document or a concrete measure.
4. Name gaps honestly. An open item with a plan and a date beats a “yes” that later turns out to be wrong.
5. Keep your answers. The next customer will ask almost the same questions.

Common mistakes

• Answering from memory without checking against your documentation
• Saying “yes” to a measure that is only half in place
• Promises in the questionnaire that don’t match your contract or data processing agreement

If the customer later asks for evidence, such an answer falls apart. That costs trust, and sometimes the deal.

How Holdvero helps

We complete the questionnaire from your own documentation, with the source next to every answer. If evidence is missing, we say so and write an open item instead of a “yes”. A questionnaire of up to 150 questions costs €695 and comes back within 3–5 working days. Holdvero does not certify and does not give legal advice; you decide what goes to your customer.