Why the questionnaires are arriving
NIS2 came into force through national law across the EU from October 2024. It covers energy, transport, banking, health, water, digital infrastructure, public administration, manufacturing of certain goods, food, digital providers and more, and it requires covered organisations to manage supply chain security: to assess the security of their direct suppliers and service providers. The practical form of that assessment is a questionnaire, and it is going to every supplier with access to the organisation's systems or data.
What a NIS2-shaped questionnaire asks
The directive lists the measures covered entities must take, and the questionnaires follow the list: risk analysis and security policies; incident handling; business continuity, backups and crisis management; supply chain security, which means questions about your own suppliers; security in acquiring, developing and maintaining systems, including vulnerability handling; how you assess the effectiveness of your measures; cyber hygiene and training; cryptography; human resources security and access control; and multi-factor authentication and secure communications.
The incident questions are the distinctive ones. A covered entity must give an early warning to its authority within 24 hours of becoming aware of a significant incident, so it will ask whether you will notify it fast enough, through which channel, and with what information. Have an answer with a time and a named contact.
Answering as a vendor
Answer as for any security questionnaire: the control, the owner, the frequency, the evidence. Two additions earn trust with NIS2 reviewers. First, a clear incident notification commitment: "we notify affected customers within X hours of confirming an incident affecting their data, by e-mail to the named security contact, with a follow-up within 72 hours". Second, your own supplier list: the customer's obligation follows the chain, so they will ask who your hosting, e-mail and AI providers are and how you assess them.
The same answers, one more heading
The measures NIS2 lists overlap almost entirely with ISO 27001's controls and SOC 2's security criterion. A library with one approved answer per control answers a NIS2 questionnaire too; what changes is the emphasis on notification, continuity and suppliers. Responsemate drafts each questionnaire from that one library and shows where your answers are thin, which for NIS2 is usually the notification and supplier rows. How the knowledge base keeps answers current.
Questions people ask
Does NIS2 apply to us if we are a small software vendor?
Usually not directly. NIS2 covers essential and important entities in listed sectors above a size threshold. But if your customers are covered, they must manage the risk you represent, and their questionnaire is how they do it. Being outside NIS2 does not spare you the questionnaire.
What does a NIS2 questionnaire ask that others do not?
More about incident notification (can you tell the customer fast enough for them to meet their own 24-hour early warning duty), about business continuity and crisis management, and about your own suppliers, because the directive follows the chain.