Contents
Part I · Why you are being asked
- 1Three laws, one mechanismYour customer has to manage their supply chain. They can only do that if you answer. That is why the questionnaire is on your desk.
- 2Whether you are covered yourself — a signpostWhich questions you have to ask yourself, where the answer is found, and when the questionnaires will arrive in Austria. Not a yes-or-no test.
- 3If your customer is a financial entityDORA turns every IT service provider of a bank or an insurer into an "ICT third-party service provider" — and imposes obligations on the customer that they pass on to you.
- 4If your customer manufactures products with digital elementsThe Cyber Resilience Act falls on manufacturers. Whoever only uses is not covered — but whoever supplies components, software or devices to a manufacturer is asked by them.
Part II · What is asked
- 5The questionnaire: fourteen recurring topicsThere is no official model questionnaire. What customers send out is assembled from standards, insurers' conditions, audit schemes and the contractual requirements of the laws — and can be traced back to fourteen topics.
- 6The contract clauses: eight under the Implementing Regulation, nine plus six under DORAThe only official texts that say what a major customer should write into the contract with its supplier — and thus the best preview of what will be put in front of you.
- 7The evidence: what is asked for, what a small company can provideCertificate, label, self-declaration, audit report, insurance confirmation — which form serves which purpose, and why none of them fulfils a legal obligation of the supplier, because there is none.
- 8Your customer's registersWhy your customer needs your master data, your contact point and your subcontractors — for registers the law requires of them.
Part III · What a usable answer is, and what you write down beforehand
- 9Three levels of answerWe have it, with an attachment. Partly, by when. Not applicable, because. Why a "yes" without foundation is more expensive than an honest "not yet" — and how a supplier statement is built that carries both.
- 10The minimum every answer rests onResponsibilities, reporting route, backup, access, updates — five sheets a company without an IT department can produce itself and that answer half of every questionnaire.
- 11Training, staff, subcontractors, locations, terminationThe questions that point inwards — what the customer wants to know about your people, your suppliers, your locations and the end of your contract.
- 12What is negotiable — and when "not applicable" is the right answerAudit rights, liability for subcontractors, reporting deadlines, background checks, insurance — as points for negotiation, not as legal advice. And where legal review belongs.
Part IV · Appendix
- 13Self-assessmentTwenty statements in five areas of action. The assessment shows which answers you can give today and which attachments are still missing. Time required approximately fifteen minutes.
- 14UncertaintiesWhat could not be read, substantiated or clarified for this handbook — with the reason and with the date on which it was last searched for. None of it has been silently smoothed over.
- 15GlossaryTerms this handbook uses and that Volume 1 does not explain. Legal terms carry the reference of their definition.
- 16List of sourcesListed are exclusively sources that were consulted for this handbook — with the route of access by which they could be read. Secondary sources carry no legal statement on their own.