Sample · Part I · Sections 1 – 4 · Why you are being asked

Three laws, one mechanism

The questionnaire does not arrive because your customer distrusts you, and not because a law obliges you to anything. It arrives because your customer has to demonstrate something they cannot demonstrate without you: that they know the security risks emanating from their suppliers, and that they manage them. This section shows the mechanism using the NIS 2 Directive, because it is formulated most clearly there. The two other legal acts — DORA for financial customers, the Cyber Resilience Act for manufacturer customers — follow the same pattern and are dealt with in Sections 3 and 4.

1.1 Whom the directive addresses — and whom not

Directive (EU) 2022/2555 addresses the Member States and, through them, "essential and important entities". These are companies and organisations from certain sectors above a certain size, plus some kinds of entities regardless of their size. Which ones is the subject of Section 2. For this section one sentence suffices: as a rule, your customer is such an entity, and you are not.

The central provision is Article 21. Its first paragraph reads:

"Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services."

The addressee of every sentence is the entity. Nowhere in Article 21 is there a sentence that obliges a supplier of that entity. What you receive is the effect of someone else's obligation — and that is the first sentence you should keep in mind for every conversation with your customer: the requirement has an addressee, and it is not you.

1.2 The ten measures, and the one that concerns you

Paragraph 2 lists what the entity's measures must "at least" include. There are ten points, and they read like the table of contents of every questionnaire you will ever receive:

"(a) policies on risk analysis and information system security; (b) incident handling; (c) business continuity, such as backup management and disaster recovery, and crisis management; (d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers; (e) security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure; (f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures; (g) basic cyber hygiene practices and cybersecurity training; (h) policies and procedures regarding the use of cryptography and, where appropriate, encryption; (i) human resources security, access control policies and asset management; (j) the use of multi-factor authentication or continuous authentication solutions […]"

Point (j) continues, rendered in substance, with secured voice, video and text communications and, where appropriate, secured emergency communication systems within the entity.

Point (d) is the reason for this handbook. "Supply chain security" means: the entity has to treat the relationship with its direct suppliers — that is, with you, if you supply it directly — as a security matter. The other nine points are the reason for what is asked: if the entity itself has to demonstrate backups, access control, training and incident handling, it wants to know whether its supplier has a hole in the same places. A customer who asks you about backups, accounts and an emergency plan is essentially asking you points (c), (i) and (b) of their own catalogue of obligations.

1.3 What the entity has to know about you

Paragraph 3 says what the entity has to consider with regard to the supply chain: when considering which supply chain measures are appropriate, entities are to

"take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures".

Three things are contained in it, and from each follows a form of request you will come to know.

First, the "vulnerabilities specific to each direct supplier and service provider". The entity has to know them — per supplier, not in general. Hence the questionnaire: it is the tool with which a purchasing department records a hundred suppliers one by one.

Second, the "overall quality of products and cybersecurity practices". The entity has to assess how you work, not only what you deliver. Hence the questions about written security rules, about updates, about the person responsible.

Third, "including their secure development procedures". That concerns software houses and suppliers of devices: the entity wants to know whether what you develop is developed securely. Hence the questions about code review, about third-party components, about the handling of reported vulnerabilities.

And proportionality? It is in paragraph 1, but it applies to the entity, not to you: when assessing the proportionality of the measures, due account is to be taken of the degree of the entity's exposure to risks, the entity's size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.

The yardstick is therefore the size and the risk of the entity. A hospital may ask more of its maintenance contractor than a logistics company of its cleaning service — not because the maintenance contractor matters more, but because the customer carries a different risk. That is also the explanation for why two customers of the same size can send you very different questionnaires.

1.4 The contract as a tool: what the directive "encourages"

The directive does not say how the entity is to secure its supply chain. It names no form, no questionnaire and no certificate. But its recitals give a direction, and that direction is the reason for the clauses in your contracts: essential and important entities

"should in particular be encouraged to incorporate cybersecurity risk-management measures into contractual arrangements with their direct suppliers and service providers".

Those entities could also consider risks stemming from other levels of suppliers and service providers.

A recital is not a legal rule; it gives the reasons for what the articles order. But it shows where the practice of writing security requirements into purchasing conditions comes from: the legislator expressly encouraged it. And the second sentence shows why you are also asked about your suppliers — the "other levels". For your customer, your subcontractors are the second level of their supply chain.

For the digital providers to which a Commission Implementing Regulation applies, the "should be encouraged" has become a list: eight points that belong in the contract with the provider. Section 6 deals with them. They are the most precise evidence of what a major customer should write into the contract with its supplier — and thus the best indication of what will be put in front of you.

1.5 Two sentences that explain the rest

Two further passages of the directive explain why customers are unyielding on certain questions.

The first concerns incidents. Article 23 obliges the entity to notify significant incidents within short time limits — and to inform the recipients of its services. Where appropriate, the entities concerned inform the recipients of their services without undue delay of significant incidents that are likely to adversely affect the provision of those services.

An entity that itself has to issue an early warning within 24 hours can only do so if its service provider informs it immediately when something happens on the provider's side that touches the entity's systems. That is the reason for the clause you will see most often: the duty to report incidents without undue delay. It is not harassment. It is the only way for your customer to keep their own deadline.

The second passage concerns corrections. If an entity finds that it does not comply with its measures, it has to take, without undue delay, all necessary, appropriate and proportionate corrective measures.

So if an entity learns that a supplier does not deliver what they ticked in the questionnaire, it is obliged to correct — and the obvious correction is to change the supplier. That is the sober reason why Section 9 places so much weight on the honest answer: a "yes" that is not true is, for the customer, a deficiency they must remedy.

1.6 What the chambers observe

The Austrian Federal Economic Chamber describes the practice on a page of its own on supply chain security: service providers and suppliers of affected entities are being "contractually obliged to risk-management measures"; entities are "already now, in preparation, demanding corresponding evidence" or writing requirements "into their contracts and purchasing conditions"; suppliers are "indirectly affected".

"Indirectly affected" is the phrase that carries this handbook. It says both things: you are not the addressee of the law — and you receive the requirement anyway. The rest of this handbook deals with what follows from that in practice.