Sample · Part I · Section 1 · Before you answer

Why you are being asked, and how to answer

In brief: Three sets of rules direct large customers to vet their suppliers; the questionnaire is the consequence. The three answer levels, with examples from a business with eight employees.

The questionnaire is not a claim that your business is subject to a rule. It is the customer's attempt to meet an obligation of its own. Whoever understands that answers more calmly — and more honestly.

1.1 Three sets of rules, one mechanism

The NIS 2 Directive requires the entities it covers — energy suppliers, hospitals, transport operators, larger manufacturers of certain goods, digital services and many more — to take measures for the security of their network and information systems. These measures expressly include “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. In doing so the entity is to take into account “the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers […]”.

The addressee of these sentences is the entity, never the supplier. But the entity can only take into account the “vulnerabilities specific to” its supplier if it knows them. Hence the questionnaire. It can only assess its “cybersecurity practices” if the supplier describes them. Hence the questions about policy, backups, updates. And it is to incorporate security measures “into contractual arrangements with their direct suppliers […]”. Hence the clauses.

In Austria the NISG 2026 transposes this requirement. According to the information documented in the research it enters into force on 1 October 2026; covered entities have to register and, within twelve months, submit a self-declaration on their measures, which according to the available excerpts also covers information on supply chain security. Whoever has to provide that information will have questioned its suppliers beforehand. The wording of the relevant sections could not be read against the official text for this kit — check current status, see section 9.

The second set of rules is DORA, the regulation on digital operational resilience for the financial sector. It has applied since 17 January 2025 to banks, insurers, payment service providers, investment firms and other financial entities — and it prescribes to them what every contract on ICT services must contain. Financial entities may “only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards”. Whoever supplies software, hosting, IT operations or other digital services to a financial entity is such a third-party provider, regardless of size.

The third is the Cyber Resilience Act for products with digital elements. It obliges manufacturers to exercise due diligence when integrating sourced components. A small software or component supplier delivering to a manufacturer is therefore asked how long it provides updates and how it handles vulnerabilities. The manufacturer obligations apply from 11 December 2027; the questions arrive earlier.

1.2 What the questionnaires contain

There is no official model supplier questionnaire for any of the three sets of rules. What customers send out is assembled from four sources: the contract requirements of the legal acts themselves, the titles of the ISO/IEC 27001 controls on supplier relationships, assessment schemes for small businesses such as DIN SPEC 27076, and the questionnaires of insurers. The questions in this kit are compiled from exactly these sources; each carries its reference.

The twelve topics of the question catalogue are: organisation and responsibility; access and identity; backups; emergency and business continuity; updates and device protection; incidents and reporting; staff and training; subcontractors; data protection and encryption; evidence, audit rights and termination; insurance; location and data. A questionnaire rarely asks everything; most ask half.

1.3 The three answer levels

Every question in the catalogue has three model answers. You choose the level — honestly.

Level 1: we have it. What is asked exists, is written down and can be evidenced. The answer states what applies, since when, who is responsible and which attachment shows it.

Level 2: partly. One part exists, one part is missing. The answer separates the two clearly and names a date for the missing part.

Level 3: not yet — with a date. What is asked does not exist. The answer says so, says what applies instead, and names a date by which it will exist. This is the most important level of the kit: a “not yet, by the end of the quarter” is a complete, usable answer. A “yes” that is not true is not.

Add to this not applicable — for questions that do not fit your service, always with the reason.

1.4 A business with eight employees

The following examples come from a fictitious installation business with eight employees that has maintenance contracts with an energy supplier. The supplier has sent it a questionnaire with 34 questions, deadline four weeks. The names are placeholders, as in the files.

Question: “Do you have a written security policy?” The business has none. There is a notice in the workshop saying who may unlock the server cabinet, and the managing director sets up all accounts herself. Level 3:

Not yet. There is no written policy so far; in practice only management sets up accounts, and access to the server room is limited to two people. From now on management is responsible. We will provide a policy by 31 December 2026.

Question: “Is your data backed up regularly, and have you tested the restore?” The accounts are backed up automatically to a provider every night; the workshop files are on a computer that is occasionally copied to an external hard disk; nobody has ever tried a restore. Level 2:

Partly. The accounts are backed up automatically every day; the workshop files have so far been backed up manually and irregularly. We will move them to the same automatic backup by 15 November 2026. A full restore test is outstanding and scheduled for 30 November 2026; we will forward the log.

Question: “Do you report security incidents to us within 24 hours?” The business has never reported an incident and has no reporting route. But the managing director can be reached by phone at any time, and the questionnaire names a contact point at the energy supplier. Level 3, but with a commitment the business can keep:

So far there is no defined route for reporting to customers. From now on: incidents that could affect your systems or data are reported by management within 24 hours of becoming aware, by phone to your contact point, and confirmed in writing. We will define deputy and availability outside office hours by 31 October 2026 and inform you.

Question: “Do you carry out background checks for persons with access to our systems?” The business has no access to the supplier's systems; its fitters enter its facilities with visitor passes. Not applicable, with reason:

Not applicable: our staff have no access to your network and information systems. They enter your facilities as registered visitors under your rules. Should this change, we will first clarify with a professional which check is permissible and sensible for us, and agree it with you.

Question: “Is there cyber insurance?” No, and the business has never considered it. Level 3 — and the counter-question that makes the answer usable in the first place:

No, no cyber insurance at present. We will examine by 31 December 2026 whether to take one out. If you make cover a condition, please state the sum you expect.

Four of the five answers are “not yet” or “partly”, and the business has answered well: the supplier knows where it stands, who is responsible and when what will change. The dates lie between six weeks and three months, none in the holiday season, each assigned to one person.

1.5 What the answers rest on

All five answers above rest on things the business knew beforehand or could establish in an afternoon: who sets up accounts, what is backed up, who can be reached, whether there is access to customer systems, whether a policy exists. That is no coincidence. A questionnaire can only be answered if seven things are settled in the business: responsibilities, backup, access, emergency, training, subcontractors, reporting route. They are on the sheet “Write down first”, with which part II begins.