Complass
Your customer's security questionnaire: NIS2 for suppliers and service providers
186 questions, three weeks to answer, and the law behind them does not even apply to you. Why NIS2 still reaches you and how many questionnaires turn into a single piece of evidence.
Many companies are not in scope of NIS2 themselves and still receive security questionnaires, contract clauses and audits from their customers. The reason: entities in scope must manage the security of their supply chain (Section 30(2) no. 4 BSIG, Art. 21(2)(d) NIS2) and pass this duty on to suppliers and service providers; manufacturers additionally ask under the Cyber Resilience Act (Art. 13(5) CRA).
The whitepaper opens with a questionnaire of 186 questions and explains from the supplier's point of view what customers typically ask and why (down to the eight contract points of Implementing Regulation (EU) 2024/2690), how to answer many questionnaires with one piece of evidence using ISO/IEC 27001 and, in OT, IEC 62443 as the backbone, how to prepare for supplier audits, and gives a 10-step roadmap.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot (decision W11); only features already live are named.
14 pages · Version 1.1 · as of 10.10.2026 · Author Complass · erstellt mit KI-Unterstützung, fachlich geprüft von Marc Linden
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.