November 2026. NIS2 asks organisations to control the security of their supply chain. As an IT supplier, installer or service provider you may not be in scope yourself, but your customer is. The result: a growing stream of questionnaires, contract clauses and audit requests.
What customers typically ask
The questions are fairly predictable: do you hold a certification such as ISO 27001, how do you handle incidents and within what time frame do you report them, which subcontractors do you use, how do you manage access and encryption, and how do you test backups? See also our explanation of supplier management.
One answer bank instead of fifty questionnaires
Build a central set of standard answers with references to evidence: policies, certificate, reports. Each new questionnaire is then answered by copying and checking instead of writing from scratch. Review the set at least every six months.
Contract clauses: read them carefully
Customers pass obligations down: notification deadlines, audit rights, requirements for subcontractors and termination terms. Assess what you can deliver before you sign; a promise you cannot keep is a risk to yourself. See also the processor agreement.
Evidence that says more than a claim
An ISO 27001 certificate whose scope covers your service is the strongest standard evidence, because it is an independent assessment. Without a certificate, a short security description, a recent pentest report and an overview of policies help. If you see many customer questions, certification pays off.
Where to start
Make an inventory of your current customer obligations, map them to your existing measures and record the gaps. The readiness scan shows where those gaps are.
This article is general information and not legal advice.