Step 3 of 4 · Collect evidence

Start with what you already hold

Read the contract first. Then check what is on file and what the supplier publishes. Ask the supplier only for what is still missing.

This step produces:

03Per-supplier assessment evidence on a known cadence

1. Read the contract against eight terms

Start with the contract: you already hold it, and it records what the supplier has agreed to do. Read it with everything it refers to: a security schedule, the data processing agreement, the service level agreement, or the standard terms accepted when someone signed up online.

These are the contract terms listed in Implementing Regulation (EU) 2024/2690, Annex point 5.1.4. That regulation binds only the provider types it names, such as cloud, data centre, DNS, managed service and trust service providers, and even for them each term applies "where appropriate". Austria goes further: since 2 October 2026, its NISV 2026 ordinance applies the same terms, "where appropriate" included, to every essential and important entity. For everyone else they are a useful reference: NIS2 Recital 85 encourages building security into supplier contracts. Check your national law too: start from the country pages.

(a)Security requirements for the supplier
(b)Supplier staff: awareness, skills, training, certifications
(c)Background checks on the supplier's staff
(d)Incident notification without undue delay
(e)The right to audit, or to receive audit reports
(f)Vulnerability handling by the supplier
(g)Subcontracting rules and subcontractor security duties
(h)Exit duties, such as retrieval and disposal of your information

For each term, note Yes, No, Partly or Not applicable, and the clause where you found it, so the next reader doesn't have to search again. Partly covers cases such as a data processing agreement that makes the supplier report incidents involving personal data, but not other incidents that put your systems at risk. Not applicable is for a term that doesn't fit the service, such as background checks for a supplier whose staff never reach your systems or data.

A current contract may lack some of these. Plan to add them at the next renewal: note the renewal date, and record the fix as a condition of your decision in Step 4.

What each term asks for, and how to add the missing ones at renewal: the eight supplier-contract clauses in the NIS2 implementing regulation.

2. Check what is on file and what the supplier publishes

For every document: does it cover the service you buy, is it current, and who stands behind it?

How to read what you get

Read the contract and what you already hold before you ask the supplier for anything. Then ask the same three questions of every document:

Does it cover the service you buy? A document about a different product, site or part of the company is not evidence for yours.
Is it current? Every certificate and report has dates. Check them against today, not against the day you received it.
Who stands behind it? An independent auditor's report weighs more than the supplier's own statement. Both can be useful; record which one you have.

Then write down what you relied on (see "Record it" below).

ISO/IEC 27001 certificate

Scope. The scope statement on the certificate should name the service you buy, or the part of the organisation and the sites that deliver it. A certificate that covers the head office's internal IT says nothing about the hosting platform you use. If the wording is too vague to tell, ask for the scope document or the Statement of Applicability (the list of controls, whether each one is in place, and why any are left out).
Dates and edition. A certificate runs for three years, with surveillance audits in the years between. Certificates to the 2013 edition of the standard expired or were withdrawn by 31 October 2025, so a certificate that still says ISO/IEC 27001:2013 is no longer valid.
Who issued it. A certificate from an accredited certification body shows the accreditation symbol of a national accreditation body, or states the accreditation in words: for example the Slovak National Accreditation Service (SNAS), the Czech Accreditation Institute (ČIA), Akkreditierung Austria, the German Accreditation Body (DAkkS) or the Dutch Accreditation Council (RvA). A certificate with neither is weaker evidence; ask why. One exception: in Germany, the Federal Office for Information Security (BSI) issues ISO 27001 certificates on the basis of IT-Grundschutz itself.
Look it up. Check the certificate in the certification body's own register, and in IAF CertSearch (iafcertsearch.org), the global database of accredited certificates. Accredited bodies have had to upload their certificates there since October 2024, so a missing entry is a question for the body.
"Compliant" is not "certified". "ISO 27001 compliant" or "aligned with ISO 27001" is the supplier's own description, not a certificate.

Assurance reports: SOC 2, ISAE 3000, ISAE 3402, BSI C5

An assurance report is an independent auditor's report on the supplier's controls. SOC 2 is the US format, set by the American Institute of Certified Public Accountants (AICPA). Two international standards, from the International Auditing and Assurance Standards Board (IAASB), sit behind many European reports: ISAE 3000 (Revised), used for reports on security controls, and ISAE 3402, which covers controls relevant to customers' financial reporting; with an ISAE 3402 report, check that it covers the security of the service you buy. BSI C5 is the German Federal Office for Information Security's criteria catalogue for cloud services, reported on under ISAE 3000 (Revised) or a national equivalent such as IDW PS 860, from the Institute of Public Auditors in Germany (IDW); BSI takes no part in the audit. Note the C5 edition: C5:2020, or C5:2026, which applies from June 2027.

Type 1 or Type 2. A Type 1 report looks at how the controls are designed, on one date. A Type 2 report tests whether they worked over a period. For a service you rely on every day, a Type 2 tells you more.
The opinion first. An unmodified opinion (older reports say "unqualified") is the clean result. A qualified opinion means a problem in one part: a control, or the description of the system. An adverse opinion (problems throughout) or a disclaimer (no opinion at all) is more serious. Read the reason before anything else.
Your service in the description. The system description must include the service you buy and the locations it runs from. For a SOC 2, check which trust services categories it covers: security is always in; availability, processing integrity, confidentiality and privacy only when named.
Exceptions. The testing section lists what the auditor found. An exception doesn't fail a report on its own; what matters is which control it hit and what was done about it. Management's responses are the supplier's own words: the auditor reads them but doesn't test them. An exception in access management or change management on the service you use deserves a follow-up question.
Suppliers behind the supplier. "Carve-out" means a company behind the service, often the hosting provider, was left out of the testing: the report covers only how the supplier monitors it. Ask for that company's own report. "Inclusive" means its controls are described and tested too.
Controls you are expected to run. The report lists complementary user entity controls: what the supplier assumes you do, such as managing your own users' access. Where you don't, part of the report's comfort doesn't apply to you. Copy them into your own list.
The months since. A Type 2 report covers a stated period. For the time since the period ended, ask for a bridge letter: the supplier's signed statement that it knows of no material change to the system or its controls since then, or a list of the changes. No auditor checks it, so it weighs less than the report.

Automotive: TISAX

In automotive supply chains, ask the supplier to share its TISAX assessment result with you through the European Network Exchange (ENX) portal (you need to be a registered TISAX participant to receive it). Check the scope (which locations), which assessment objectives the labels cover, and the expiry date. A temporary label is weaker, and a label for a different location says nothing about the one that serves you.

Penetration test

What to expect. A summary or a letter of attestation, not the full report: the details are sensitive for the supplier too. That's a reasonable answer.
What to check. What was tested (the service you use, or something else? From outside only, or with a logged-in account as well?), when, and by whom: an independent tester, not the team that built it. Were the serious findings fixed and checked again?
How recent. Your policy sets how recent a test must be, by tier.

Sub-processor list (the sub-suppliers that handle your data)

Each entry: the name, what it does for the service, where (country), and which of your data it touches.
How you hear about changes. When the supplier processes personal data for you under a general written authorisation, GDPR Article 28(2) has it tell you of any intended addition or replacement of a sub-processor, so you can object. Check how your contract says you'll be told, and that someone on your side reads those notices.
Check it against your risk answers. If the list shows processing or support outside the EU/EEA, the answer to risk question 10 may need to change.

Trust pages and documents shared under a non-disclosure agreement (NDA)

Some providers publish their certificates and reports on a trust page, or share them after you sign an NDA. Read those before you send a questionnaire, and ask only what they don't answer. A SOC 3 on a trust page is a short public summary; it doesn't give the detail of a SOC 2. Pages change, so record the document, its version or date, where you found it, and the day you looked.

Red flags, whatever the tier

The scope doesn't name the service you buy.
The certificate has expired, or is still to ISO/IEC 27001:2013.
No accreditation symbol or statement, or "compliant with" where you expected "certified".
A gap between the end of a report's period and today, with nothing covering it.
The supplier won't name its sub-processors. Record "Supplier won't say": it is the riskier answer, not a blank.
The documents describe a different product, company or site than the one you buy.

Record it

For every answer: where it came from (your own records, or the supplier), the date, who accepted it, and what it covers. One line is enough, for example: "ISO/IEC 27001:2022 certificate; scope covers the hosting platform; valid to March 2027; checked in the certification body's register."

3. Ask only for what is still missing, and record where each answer came from

Send the supplier only the questions your contract and your files leave open. It means fewer emails on both sides, and it suits providers that answer from their published reports rather than questionnaires.

Match what you ask for to the tier: lighter for Low, fuller for High and Critical. Your policy sets what each tier needs, for example the contract terms alone for Low, and for Critical the contract terms, certificates, audit reports and a penetration test.

Let your Step 2 answers point to the questions. A supplier that puts updates into your systems (question 8): ask how it handles vulnerabilities and tests what it ships. One that holds your data (questions 3, 9 and 10): ask where it is kept and who else handles it. One with admin access (questions 6 and 7): ask how that access is controlled and logged.

Ask every supplier in scope for a security and incident contact, and give it yours, so an incident reaches the right person on both sides. Record each answer with its source and date, as "Record it" above describes.

Checklist

The contract is read against the eight terms for every supplier in scope, and gaps are noted.
What you hold and what the supplier publishes was checked before asking.
What you ask for matches the supplier's tier: lighter for Low, fuller for High and Critical.
Every answer has a source (your own records, or the supplier), a date, and the name of whoever accepted it.
The supplier's security and incident contact is on record.

Ticks aren't saved. The same checklist is in the PDF.

In the Excel file, use the Step 3 Contract check and Step 3 Evidence sheets.

End of Step 3 of 4

Next: Step 4A decision you can defend later

Three years from now, after staff turnover, the record still has to show who decided, on what evidence current at the time, with what conditions, and when you planned to look again.

Previous: Step 2 — How much risk each supplier brings Back to the kit overview

Vittnor by Shards Cybersecurity · shardscybersecurity.io · version 1.2 · last reviewed 20 October 2026

Licence: CC BY 4.0. Free to use inside your organisation, and to show to your auditors and suppliers. If you publish it or hand it out as a template, keep the credit line and say what you changed.

This kit supports your Article 21(2)(d) work; it is not legal advice. It lists contract terms to look for, but doesn't judge whether a contract is adequate. No tool or template makes you NIS2 compliant — compliance is the entity's responsibility, and the competent authority and your auditors judge it.