Your customer asks for a NIS2 Supply Chain certificate. Now what?
The NIS2 Supply Chain certificate is a voluntary quality mark for suppliers to organisations in scope of NIS2. It has three levels: SC10, SC20 and SC30. The law does not prescribe a certificate. Your customer can ask you to demonstrate that you operate securely, and decide for itself whether it requires a certificate for that. So first ask what your customer actually expects: the certificate, or answers with evidence.
A customer in scope of the Dutch Cybersecurity Act can ask you to demonstrate that you operate securely. Sometimes it mentions the NIS2 Supply Chain certificate. This is what it is, and what you can do if you do not have it (yet).
What the certificate is
The NIS2 Supply Chain certificate was developed by the Dutch Stichting Kwaliteitsinnovatie (Kiwa, NIS2 Supply Chain, in Dutch). It was launched in October 2024 as the NIS2 Quality Mark, with the levels QM10, QM20 and QM30 (Accountancy van Morgen, 11 October 2024, in Dutch). The levels are now called SC10, SC20 and SC30. It is a quality mark, not a law.
The scheme’s website describes the levels as follows (NIS2 Supply Chain, FAQ):
| Level | For whom |
|---|---|
| SC10 | SMEs with a limited risk that supply organisations in scope of NIS2 |
| SC20 | Companies with an elevated risk because of their role or their access to sensitive data |
| SC30 | Critical companies in the supply chain, where a disruption can have major consequences |
Is it mandatory?
Not under the law. Organisations in scope of NIS2 must manage the security of their supply chain. That is why they can require their direct suppliers to demonstrate that they operate securely (NIS2 Supply Chain, FAQ). The Dutch NCSC writes that certificates can help, but that the Cybersecurity Act does not prescribe them (NCSC, Suppliers of Cbw organisations, in Dutch). So whether you need a certificate is up to your customer, for example in a tender or in the contract. More on what a customer in scope can ask of you: Dutch Cybersecurity Act: what can your customer require of you?
How to obtain the certificate
According to the scheme’s website it takes five steps (NIS2 Supply Chain, for companies):
- You pre-register your organisation.
- You prepare for the audit: documentation and measures in order.
- You attend a pre-audit webinar. This is mandatory if you want to obtain the certificate.
- An independent, recognised auditor of your choice carries out the certification audit.
- After a positive assessment you receive the certificate.
For SC20 and SC30 the auditor must have knowledge of ISO 27001 (FAQ). One of the certification bodies mentions a three-year certification cycle for SC20 and SC30 (Kiwa, in Dutch). Check the current conditions and costs with the auditor you choose.
First ask what your customer really wants
- Is the certificate a hard requirement, or is equivalent evidence also acceptable?
- Which level does the customer expect, and why that level?
- By when must you have it: before the award, or within a period after the start?
- Does the customer also accept ISO 27001, or an earlier audit?
- Does the customer also want a questionnaire completed?
What you can provide now
If you do not have a certificate (yet), you can still show which measures you have. This evidence fits the topics a customer may ask about:
| Topic | What your customer wants to know | Evidence you can show |
|---|---|---|
| Policy and risks | Have you mapped your security and your risks? | Information security policy, risk assessment, overview of measures |
| Access | Who can access what, and is MFA on? | MFA settings, overview of access rights, joiner and leaver procedure |
| Updates | How quickly do you install security updates? | Patch policy, overview of recent updates |
| Back-ups and recovery | Can you restore your data? | Back-up policy, report of the latest restore test |
| Incidents | How do you report and contain an incident? | Incident procedure, contacts, notification times |
| Your own suppliers | Who else works on the service for you? | List of suppliers and sub-processors, their certificates or reports |
| Awareness | Do your staff know what to do? | Overview of trainings and who attended |
How strong each kind of evidence is, you can see on the evidence ladder. Be honest about what is not there yet. For example: “We do not have a NIS2 Supply Chain certificate. Our measures are described in document X; the September restore test is in report Y.”
Certificate, ISO 27001 or answers with evidence?
| Route | When it fits | Watch out |
|---|---|---|
| Answers with evidence | Your customer does not ask for a certificate, or accepts equivalent evidence | Work per customer. Keep your answers and evidence current and in one place. |
| NIS2 Supply Chain certificate | One or more customers explicitly ask for it | A project with preparation, webinar and audit. Choose the level your customer asks for. |
| ISO 27001 | Customers specifically ask for ISO 27001 | A bigger project. Check that the scope covers your service. See questionnaire without ISO 27001. |
What not to write
- “We are NIS2 compliant”. The law applies to your customer; you show which measures you have.
- “We meet SC20” without an audit. That can be read as a certificate.
- A certification date that has not been planned yet.
If you do have the certificate, state the level, the date and the auditor, and send the certificate along.
How Holdvero helps
With Questionnaire Rescue we answer your customer’s questions based on your own documentation, with a source for every answer and honest open items. That way you show what you already have, even without a certificate. Holdvero does not certify, audit or guide certification projects. More about Dutch customers on the Netherlands page.
Frequently asked questions
Is the NIS2 Supply Chain certificate mandatory?
Not under the law. The Dutch Cybersecurity Act does not prescribe a certificate. Your customer can require it, for example in a tender or the contract.
Which level do I need?
That depends on your role in the supply chain and on what your customer asks. According to the scheme's website, SC10 is for SMEs with a limited risk and SC20 for companies with an elevated risk, for example because of access to sensitive data. Ask your customer which level it expects.
Is this the same as ISO 27001?
No. ISO 27001 is an international standard for an information security management system. The NIS2 Supply Chain certificate is a quality mark with levels for suppliers in the NIS2 supply chain. Ask your customer whether it also accepts ISO 27001.
Was this previously the NIS2 Quality Mark?
Yes. The mark was launched in October 2024 as the NIS2 Quality Mark, with the levels QM10, QM20 and QM30. They are now called SC10, SC20 and SC30.
Can Holdvero certify me?
No. Holdvero does not certify or audit. We help you answer your customer's questions honestly and with evidence.
Is your customer asking for a certificate or a questionnaire?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price