The handbook
Cover, scope and price. Buying takes only an e-mail address.
Handbooks · Volume 3
What your major customer will ask of you
NIS2, DORA and the CRA from the supplier's side: why the questionnaire arrives, what is asked, and what a usable answer looks like.
- 16 sections in 4 parts, the last part is the appendix with 4 sections
- Online reading access via your personal link
- Full handbook as a PDF
€49.00incl. VAT. One-off payment, no subscription.
Free to read: Purpose and structure, Contents, Three laws, one mechanism.
The contents
16 sections in 4 parts, the last part is the appendix with 4 sections. Free to read: Purpose and structure, Contents, Three laws, one mechanism.
Part I · Sections 1 – 4
Why you are being asked
- 03Three laws, one mechanism
- 04Whether you are covered yourself — a signpost
- 05If your customer is a financial entity
- 06If your customer manufactures products with digital elements
Part II · Sections 5 – 8
What is asked
- 07The questionnaire: fourteen recurring topics
- 08The contract clauses: eight under the Implementing Regulation, nine plus six under DORA
- 09The evidence: what is asked for, what a small company can provide
- 10Your customer's registers
Part III · Sections 9 – 12
What a usable answer is, and what you write down beforehand
- 11Three levels of answer
- 12The minimum every answer rests on
- 13Training, staff, subcontractors, locations, termination
- 14What is negotiable — and when "not applicable" is the right answer
Part IV · Sections 13 – 16
Appendix
- 15Self-assessment
- 16Uncertainties
- 17Glossary
- 18List of sources
Sample
The beginning of Section 1, unchanged from the handbook. The source lines are in the reading sample.
Three laws, one mechanism
The questionnaire does not arrive because your customer distrusts you, and not because a law obliges you to anything. It arrives because your customer has to demonstrate something they cannot demonstrate without you: that they know the security risks emanating from their suppliers, and that they manage them. This section shows the mechanism using the NIS 2 Directive, because it is formulated most clearly there. The two other legal acts — DORA for financial customers, the Cyber Resilience Act for manufacturer customers — follow the same pattern and are dealt with in Sections 3 and 4.
Directive (EU) 2022/2555 addresses the Member States and, through them, "essential and important entities". These are companies and organisations from certain sectors above a certain size, plus some kinds of entities regardless of their size. Which ones is the subject of Section 2. For this section one sentence suffices: as a rule, your customer is such an entity, and you are not.
The central provision is Article 21. Its first paragraph reads:
"Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services."
The addressee of every sentence is the entity. Nowhere in Article 21 is there a sentence that obliges a supplier of that entity. What you receive is the effect of someone else's obligation — and that is the first sentence you should keep in mind for every conversation with your customer: the requirement has an addressee, and it is not you.
Newsletter and more
Keep up, and titles that go with this volume.
Goes with it