Purpose and structure
This handbook is addressed to the management of small and medium-sized companies that have received from a customer a questionnaire on information security, a contract clause or a request for evidence — without an IT department of their own, without a security officer and without anyone in the building who has ever answered such a thing before. The customer refers to NIS2, to DORA or to the Cyber Resilience Act. The reader of this handbook is the supplier, not the entity covered by the law.
It answers four questions, in this order: Why does your company of all companies receive this requirement, although it does not itself fall under the law? What exactly is being asked, and where do the questions come from? What is a usable answer — and why is a "yes" without foundation more expensive than an honest "not yet, by the end of the quarter"? And what do you write down beforehand so that the next request no longer costs you a weekend?
The order has been chosen deliberately. Accounts of this subject frequently begin with the obligations of the entities covered and thereby lose the reader they actually mean: the company that does not have the obligation and receives the requirement anyway. The legal part comes first here, but only as far as it explains the mechanism; the answer is the centre.
Structure
The handbook is divided into four parts. Part I explains why you are being asked: the supply chain mechanism in the NIS 2 Directive, the special cases of a financial customer and a manufacturer customer, and — only as a signpost — the question whether your own company might be covered. Part II shows what is asked: the topics of the questionnaires, the contract clauses, the evidence, and the registers for which your customer needs your master data. Part III says what a usable answer is, which minimum every answer rests on, and what remains a matter for negotiation. Part IV contains a self-assessment, the collected uncertainties, the glossary and the list of sources.
Scope
Three legal acts of the European Union govern: Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2022/2554 (DORA) and Regulation (EU) 2024/2847 (the Cyber Resilience Act). The two regulations apply directly in all Member States. The directive is transposed by each Member State into its own law; this handbook takes the Austrian transposition, the Network and Information System Security Act 2026 (NISG 2026), as its example and marks every Austrian passage as such. For companies in other Member States: the mechanism is the same, the deadlines and authorities are not. Where something applies only to Austria, that is stated; the transposition of other States is not presented. Switzerland is not the subject of this handbook.
Handling of sources
Every time limit and every legal statement is supported by a source and an access date. Source lines appear immediately beneath the statement in question; the complete list is found in Section 16. Verbatim quotations are set as such and carry their reference.
Where a statement could not be substantiated, this is expressly noted — as not determinable, with the reason given, and not as an estimate. These points are collected in Section 14. Three limitations concern the whole handbook and are therefore stated here. First, the Union texts were read for this handbook from copies of the Official Journal that are not official; the passages quoted were checked against the official text at EUR-Lex on 18 September 2026 (Section 14 no. 1). Second, the sections of the Austrian act that contain the catalogue of obligations of covered entities could not be read in their wording; for that catalogue the handbook therefore relies on the directive itself and says, at every point where the Austrian act is meant but was not read, that this is so. Third, and specific to this English edition: the English quotations from the NIS 2 Directive, from DORA and from the Implementing Regulation were checked against the official English version at EUR-Lex on 18 September 2026 where the source line says so; passages that this edition renders in substance from the German text are marked as such and listed in Section 14 no. 18.
A distinction is drawn throughout between what a law requires of your customer, what an authority or chamber recommends, and what is customary in practice. A questionnaire is practice. It is not a statutory command addressed to you.
This handbook is a guide. It is not a legally binding document, is no substitute for legal advice and is not a legal commentary. It does not examine whether your own company falls under a law; instead it names the questions you have to ask yourself and the place where the answer is found. It contains no model questionnaire and no model answers; that is the task of Scutoria's supplier answer kit. And at no point does it say "you must" where in truth only your customer is asking for something — because precisely that distinction is the reason it was written.