Supplier readiness check.
Two scopes — pick one inside the tool. Supply chain (default · 20 questions, ~5 min) covers documentation foundations, operational practice, supply-chain transparency, and buyer-relationship readiness — what NIS2-driven buyer questionnaires ask first. Full NIS2 (35 questions, ~8-10 min) adds dedicated coverage of vulnerability handling, cryptography depth, and cyber hygiene / access / secure communications — the deeper questions regulated buyers increasingly send. Reference-anchored (NIS2, GDPR, ISO 27001) gap report at the end.
Honest framing: this is a directional steer for how prepared you are to answer the next NIS2-driven assurance questionnaire from a regulated buyer. Sister to the buyer-side NIS2 readiness check.
Two scopes available: Supply chain (default — twenty questions, what buyers ask first) or Full NIS2 (thirty-five questions, adds vulnerability handling and secure development, cryptography depth, and cyber hygiene, access and secure communications — the deeper questions NIS2-regulated buyers increasingly send). Three answers per question. Your inputs stay in your browser; each item is anchored to the framework reference (NIS2, GDPR, ISO 27001) it draws on so you can verify the framing.
Documentation foundations
The artefacts a buyer expects to find on day one — security policy, attestation status, named ownership.
Do you have a written information security policy with version control and a documented annual review cycle?
ISO 27001 A.5.1 / NIS2 21(2)(a)Do you hold a current independent attestation (SOC 2 Type II, ISO 27001, or equivalent) — or have a defined plan with a date?
Attestation disciplineIs there a named individual (not a department) accountable for security at executive level — appearing on customer-facing trust documents?
NIS2 20 / governanceDo you maintain a customer-facing trust surface (a /trust page, a security overview PDF, or equivalent) that is current within the last 6 months?
Trust transparencyDo you have a standard Data Processing Agreement (Article 28-compliant) you can share without a legal-review cycle?
GDPR Art. 28All 35 questions
Every question in the check, by area, with the reference each one maps to. The Supply chain scope asks the first four areas, 20 questions; Full NIS2 adds the last three.
01 Documentation foundations
- Do you have a written information security policy with version control and a documented annual review cycle?ISO 27001 A.5.1 / NIS2 21(2)(a)
- Do you hold a current independent attestation (SOC 2 Type II, ISO 27001, or equivalent) — or have a defined plan with a date?Attestation discipline
- Is there a named individual (not a department) accountable for security at executive level — appearing on customer-facing trust documents?NIS2 20 / governance
- Do you maintain a customer-facing trust surface (a /trust page, a security overview PDF, or equivalent) that is current within the last 6 months?Trust transparency
- Do you have a standard Data Processing Agreement (Article 28-compliant) you can share without a legal-review cycle?GDPR Art. 28
02 Operational practice
- Is encryption documented for data at rest AND in transit, with the standard named (AES-256, TLS 1.2+ or higher)?NIS2 21(2)(h) / cryptographic baseline
- Is multi-factor authentication enforced for ALL administrative and privileged access (not just optional)?NIS2 21(2)(i) / access control
- Do you have a documented incident response plan that has been tested in the last 12 months (tabletop or live)?NIS2 21(2)(b)
- Are backups taken on a defined schedule AND restore-tested within the last 6 months?NIS2 21(2)(c)
- Do you run a vulnerability management programme with a defined cadence (monthly scans + tracked remediation SLA)?NIS2 21(2)(e) / vulnerability handling
03 Supply-chain transparency
- Do you publish a current sub-processor list (or make it available to customers on request without legal cycles)?GDPR Art. 28(2) / supply-chain transparency
- Do you notify customers IN ADVANCE of sub-processor additions or changes, with a documented right to object?GDPR Art. 28(2) / change-notification
- Do you have a documented sub-processor security vetting practice (what evidence you collect before onboarding, on what cadence you reassess)?NIS2 21(2)(d) / supplier-of-supplier
- Do you assess your own suppliers against NIS2 Article 21(2)(d) — or an equivalent supplier-risk framework?NIS2 21(2)(d) inheritance
- Do you have a defined material-change trigger process (an incident one of your suppliers reports, ownership change, certificate expiry) that initiates an out-of-cycle review?Reaction to material change
04 Buyer-relationship readiness
- Do you have a reusable evidence library so the same artefact (SOC 2, sub-processor list, BCP) is shared across all customer questionnaires without re-keying?Operational efficiency
- Do you commit contractually to a specific incident-notification window to customers (e.g. 24 hours or 72 hours after detection)?NIS2 23 inheritance / contract clause
- Do you have a documented data-deletion process at engagement end, with a deletion certificate the customer can retain?GDPR Art. 28(3)(g) / deletion proof
- Have you defined a stance on customer right-to-audit — either accepting it, or offering a credible alternative (independent attestation + management answers)?Audit-rights clause
- Do you maintain reference-able customer attestations or testimonials available under NDA when prospective buyers ask?Reference discipline
05 Vulnerability handling & secure developmentFull NIS2 only
- Do you have documented security requirements that are applied to ALL new technology acquisitions (software, services, hardware) you bring into your environment?Article 21(2)(e) inheritance
- If you build or substantially customise software, do you have a documented secure development lifecycle (SDLC) — code review, security testing, threat modelling — applied consistently?Article 21(2)(e) inheritance
- Do you have a documented coordinated vulnerability disclosure (CVD) policy — a structured channel for external researchers to report security issues to you safely?Article 21(2)(e) inheritance
- Do you have a defined stance on external pen-testing or bug-bounty programmes — whether you run them, when, and what scope?Maturity signal / 21(2)(e)
- Do you publish security advisories (or notify affected customers in advance) when you patch vulnerabilities affecting your products or services?Article 21(2)(e) / 23 inheritance
06 Cryptography depthFull NIS2 only
- Do you have a documented cryptography policy that names approved algorithms, key lengths, and protocol minimums (e.g. TLS 1.2+, AES-256)?Article 21(2)(h)
- Do you have a documented key management process — generation, secure storage (HSM or equivalent), rotation cadence, and revocation?Article 21(2)(h)
- Are cryptographic configurations reviewed at least annually against current standards (ENISA / NIST recommendations, deprecated-algorithm timelines)?Article 21(2)(h)
- Where you handle data subject to specific cryptographic regulation (e.g. payment card data, qualified electronic signatures), do you align to the corresponding standards (PCI DSS, eIDAS)?Article 21(2)(h) / sectoral overlap
- Do you have a documented stance on post-quantum readiness — even if just an awareness baseline of when you will evaluate?Article 21(2)(h) / forward-looking
07 Cyber hygiene, access & secure communicationsFull NIS2 only
- Do you have a documented cyber hygiene programme — phishing simulation on a defined cadence, password policy aligned to NIST/ENISA guidance, removable-media policy — alongside annual security training?Article 21(2)(g)
- Is there a documented access control policy — role-based access (RBAC) and least-privilege as the default — applied to ALL systems with customer or production data, including admin and break-glass paths?Article 21(2)(i)
- Do you maintain a current asset inventory (software, hardware, services, data) with named owners and classification, reviewed at least annually?Article 21(2)(i)
- Do you have HR security controls — background checks for sensitive roles, NDAs, AND a documented off-boarding procedure that revokes access within 24 hours of departure?Article 21(2)(i)
- Have you designated secure channels (encrypted voice, video, text, emergency communications) for sensitive customer and incident-response communications, and is staff trained on when to use them?Article 21(2)(j)