Key takeaways
- If your company is not in scope of NIS2 itself, the German BSI Act (BSIG) generally puts no obligations on you: no BSI registration, no reporting duty to the BSI, and no risk of fines. As a supplier, your NIS2-related obligations come solely from your contract with the customer.
- Regulated customers ask because Section 30(2) sentence 2 no. 4 BSIG requires them to secure their supply chain, and Section 30(1) sentence 3 BSIG requires them to document that they do.
- Five basics cover the typical questions in supplier questionnaires: an overview of who has access, MFA, a tested backup, an incident reporting channel, and training with evidence.
- An ISO 27001 certificate answers many questions, but only if its scope covers the service the customer buys. There is no official NIS2 certificate for suppliers.
- Every questionnaire answer should state status, scope, evidence, and owner. A blanket "We are NIS2 compliant" belongs in none of them.
By your own assessment, your company does not fall under NIS2. Even so, NIS2 reaches you through the supply chain: a customer's first security questionnaire lands on your desk, sometimes with a tight deadline, and the next contract renewal brings new clauses on incident reporting and audit rights.
If you fill in the questionnaire quickly and answer "yes" everywhere, expect follow-up questions. At the latest then, the customer will want to see evidence, such as your last backup test, your MFA coverage, or your training records.
In my experience, many mid-sized companies meet individual NIS2 requirements through their customers rather than through the law. The obligations have applied in Germany since December 6, 2025. Many regulated companies are only now starting to survey their suppliers systematically. If you prepare early and in a structured way, you save work with every additional customer.
This article explains what you need to deliver as a supplier outside NIS2 scope, what you should commit to, and what you should not.
NIS2 applicability check: Are you in scope yourself?
Regardless of any customer request, first check whether your company itself counts as an important or essential entity under Section 28 BSIG, the German law that transposes NIS2. If you are above the thresholds, the next question is whether your business matches one of the entity types listed in the BSIG. Some mid-sized companies that consider themselves out of scope are in fact covered. For them, the obligations apply directly, including registration with the BSI.
The thresholds are generally at least 50 employees, or annual turnover and annual balance sheet total each above EUR 10 million (Section 28 BSIG). The quickest way to get a first assessment of whether you are affected is the NIS2 Checker.
NIS2 in the supply chain: Why does your customer ask if you are not in scope?
Your customer has to show that it manages the risks in its supply chain appropriately, and it needs evidence from you to do so.
Regulated entities must secure their supply chain, including the security-related aspects of their relationships with their direct suppliers and service providers (Section 30(2) sentence 2 no. 4 BSIG). They must also document that they comply (Section 30(1) sentence 3 BSIG).
The BSIG transposes the NIS 2 Directive (EU) 2022/2555, and on this point the directive goes further than the wording of Section 30 BSIG. Because Section 30 BSIG has to be interpreted in line with the directive, this more specific requirement also applies to entities in Germany. Entities must take into account the vulnerabilities specific to each direct supplier, the quality of its products and cybersecurity practices, and its secure development procedures (Art. 21(3) NIS 2 Directive).
So expect your customer to ask for evidence, at the latest when it follows up or runs a supplier audit. Your customer needs evidence for each supplier that it can file and present during an inspection. That is why many questions target whether a measure is actually implemented, not just whether it exists, and for critical points such as backups or contingency plans, whether it has been tested. We describe how regulated companies approach this obligation from their side in our NIS2 guide to supply chain security.
For you, the position is different: the law does not address you. You do not have to register with the BSI, you have no reporting duty to the BSI, and you face no fines under the BSIG. Your NIS2-related obligations come solely from your contract with the customer. If your customer cannot assess your security, however, that can count against you in supplier evaluations and future tenders.
What typically appears in the questionnaire and the contract?
Most questionnaires and security annexes follow the ten measures in Section 30(2) BSIG, which we explain in our article on NIS2 risk management requirements. Typical questions cover access, backups, incidents, training, and your own subcontractors. What varies most is how deep the questions go.
There is no official format. Each customer turns its obligation into questions of its own. That is why questionnaires differ in structure and wording, even when they ask about the same requirements. The selection below uses typical examples to show what lies behind the questions and which evidence fits.
| Example questionnaire question | What the customer wants to know | Possible evidence |
|---|---|---|
| Do you use multi-factor authentication? | Does a stolen password give access to my data or systems? | Overview of systems with MFA, excerpt of the policy in the identity provider |
| Do you have a backup concept? | Can you deliver again after an outage, for example after a ransomware attack? | Concept plus the log of the last restore test |
| How do you report security incidents? | Can I quickly assess whether an incident on your side affects my services? | Named contact, reporting channel, deadline |
| Are employees trained? | Do your employees know typical attack patterns, such as phishing, and how to respond? | Training records with date and participation rate |
| Who has access to our systems and data? | Do I know every person and subcontractor with access? | List of access rights and subcontractors |
| Which certifications do you hold? | Is there independent confirmation? | Certificate with scope (see below) |
Alongside the questionnaire, security annexes to contracts are becoming more common, so prepare for one at your next contract renewal. They set out minimum measures, reporting duties toward the customer, and audit rights. The section on contract clauses covers which ones to check before you sign.
What baseline should you have before you answer?
Five basics cover the topics customers typically ask about. A supplier outside NIS2 scope rarely needs to implement all ten measures from Section 30 BSIG.
The ten measures are a sensible framework for information security. Implementing all of them only because one customer asks would usually be disproportionate for a supplier outside NIS2 scope, because your customer asks about what affects its own risks. Your customer's own measures must also be proportionate (Section 30(1) sentence 2 BSIG). What it requires from suppliers therefore depends on the risk that comes with each service. You should have these five basics:
- Access overview: Which of your employees and which of your subcontractors have access to systems, data, or premises such as server rooms?
- MFA: on all external access and on email.
- Tested backup: a restore test with date and result.
- Incident reporting channel: Who decides whether an incident affects the customer, and who informs them? With a deputy, including on weekends.
- Training with evidence: at least once a year, including management.
I recommend writing an information security self-disclosure as the basis for your answers. It should briefly describe your measures, owners, and evidence. Its scope depends on your service and on which risks affect your customers. With this document, you answer every further questionnaire much faster, because you do not have to gather answers and evidence from scratch each time.
Is an ISO 27001 certificate enough as an answer?
Often yes, but only if the scope of the information security management system (ISMS), as stated on the certificate, covers the service your customer buys.
Do not confuse an ISO 27001 certificate with NIS2 compliance, though. A common misconception is that ISO 27001 fully covers the NIS2 requirements. If you are in scope of NIS2 yourself, the legal obligations go further, for example on reporting duties to the BSI. Our comparison of NIS2 and ISO 27001 shows where the two overlap and where they do not. For you as a supplier outside NIS2 scope, a different question counts: does your certificate cover what your customer asks about?
If the service your customer buys lies outside the scope of your ISMS, the certificate alone is not enough. The customer will then ask about those points separately.
Check three things before you send it:
- Scope: Does the scope on the certificate cover the locations, systems, and services the customer uses?
- Statement of Applicability (SoA): Are the controls relevant to the customer applicable and implemented, such as access control (A.5.15), secure authentication (A.8.5), and information backup (A.8.13)?
- Validity: Is the certificate valid, and was the last surveillance audit carried out on time?
Even with a matching certificate, customers often send a questionnaire. Then refer to the certificate for each question, and attach the specific evidence wherever the customer asks for details.
And if you do not have a certificate yet?
Then for individual questionnaires, the self-disclosure recommended above is often enough, supplemented with the relevant evidence.
In my view, certification is worth it above all if one of these applies to you:
- You supply several regulated customers or receive questionnaires regularly.
- You have access to your customers' systems or data.
- Tenders or framework agreements require a certificate.
- Your customers come from industries with established standards.
Which certificate fits depends on your industry and your customers' requirements. On many topics, a certification goes beyond what a single questionnaire asks. In return, you can point every further customer to an audited system instead of compiling evidence each time. Larger companies in particular also require such certificates as a basis for working together, independently of NIS2, and in my experience this requirement keeps growing. A certified ISMS also strengthens your own information security, because you capture risks systematically, clarify responsibilities, and review measures regularly. Our guide to ISO 27001 certification describes the path there.
How do you answer without overpromising?
Answer every question with status, scope, evidence, and owner, and do not commit to anything you cannot prove.
Suppose you answer "yes" to the question "Contingency plan in place and tested annually?", although the plan exists but has not been tested yet. If the customer asks to see the test log during a supplier audit, the report records a nonconformity, and your other answers lose credibility. The answer "Partially implemented, test planned for Q2" would instead have given the customer an accurate picture of where you stand.
Every answer should contain four details:
- Status: implemented, partially implemented, planned (with date), or not applicable (with reason)
- Scope: which locations, systems, and services it covers
- Evidence: which proof shows the measure is in place, such as a document, a screenshot of system settings, or a log, available on request
- Owner: who is responsible on your side
Never write a blanket "We are NIS2 compliant." There is no official NIS2 certificate for suppliers, and the law does not address you. You cannot prove the statement, and it can come back to haunt you contractually. Treat the questionnaire as a declaration that your customer files and pulls out again at the next supplier evaluation.
Which contract clauses should you not sign unchecked?
Negotiate with a concrete counterproposal instead of rejecting a clause outright. Above all, your customer needs something it can document.
A security annex that arrives with a contract renewal can contain maximum demands. The typical points and possible counterproposals:
| Clause | Problem | Possible counterproposal |
|---|---|---|
| "The supplier meets all requirements of the BSIG" | Vague, and the law does not address you | Annex listing specific measures |
| Report every security incident within 24 hours | Too broad; the customer only needs relevant incidents | Incidents affecting customer data, customer systems, or ability to deliver, without undue delay after becoming aware, to a named contact |
| Audits at any time without notice | Disrupts your operations | Notice period, frequency, priority for certificates and reports, cost rule |
| Commitment to the customer's security policies "as amended from time to time" | The customer can change its requirements at any time without your consent | Reference to a specific version of the policies; the customer announces changes with reasonable notice and agrees them with you |
| Pass all requirements on to all subcontractors | Disproportionate for subcontractors without access | Only subcontractors with access to customer systems or data |
Clarify liability caps and contractual penalties with your legal counsel. This section does not replace legal advice.
How long does it take before you can answer reliably?
If you already have the five basics, you can usually answer a questionnaire within a few weeks. If you start from zero, expect several months instead. There is no single figure: the effort depends on how extensive the questionnaire is and how mature your existing security measures are.
A typical example is a software provider below the thresholds, which therefore does not fall under NIS2 itself. Several of its customers come from NIS2-relevant industries and have already sent security questionnaires, and more are expected. Some customers even demanded "NIS2 compliance," although the law does not address the provider at all.
The questionnaires usually run to 10 to 20 pages with 50 to 100 questions. On top of that come policies the customer wants to see and a list of subcontractors. The provider usually has two to four months to answer, sometimes only a few weeks. Because it has already implemented information security measures, a single questionnaire is manageable in that time. It gets difficult when several requests arrive at once and gaps still need closing on the side, because day-to-day business carries on.
A realistic process for your first questionnaire, in three steps:
- Read the questionnaire and clarify with the customer which service it refers to and when they need the answer. Name a person responsible. Our article on NIS2 responsibility explains who typically takes on this role in mid-sized companies.
- Close quick gaps, such as MFA, a backup test, and the reporting channel.
- Write the information security self-disclosure and back your answers with evidence. Report longer-term topics such as certification as "planned, with date."
If the deadline is too tight, ask for an extension and send an interim status with your request.
How Kertos supports suppliers with NIS2 requests
Kertos is a European compliance platform where companies build their ISMS and keep policies, responsibilities, risks, and evidence in one place. For suppliers, that means the evidence is already organized when the next questionnaire arrives, instead of having to be gathered first. The "Information Security Basics" training is included in the platform, in German and English, and each employee's completion is recorded as evidence in the ISMS.
If you are working toward ISO 27001 certification, certified Kertos experts support you through to the audit. You implement the measures; Kertos structures, documents, and supports. Every Kertos customer has passed their audit so far. In a personal demo, we show you what this could look like for your company.
Frequently asked questions
Do I have to register with the BSI as a supplier?
No, as long as you are not in scope yourself. The registration duty applies to essential and important entities and to domain name registry service providers (Section 33(1) BSIG).
Is there a NIS2 certificate for suppliers?
No. NIS2 has no certificate a supplier could use to prove "NIS2 compliance." What customers accept is evidence of specific measures or established proof such as an ISO 27001 certificate, a TISAX label, or a C5 attestation.
What happens if I do not answer my customer's NIS2 questionnaire?
You face no fine under the BSIG. If your contract requires cooperation, however, contractual consequences are possible. Your customer also has to assess and document the risk. Without your answer, it will likely rate you more cautiously, take additional measures on its side, or reconsider the relationship.
Do I have to adopt my customer's 24-hour reporting deadline as a supplier?
Not by law; contractually, it is a matter of negotiation. Your customer's 24-hour deadline only starts when it becomes aware of a significant security incident itself (Section 32(1) no. 1 BSIG). It still wants to hear quickly so it can assess the impact on its services. A sensible commitment is to report relevant incidents without undue delay after becoming aware of them, to a named contact.
Do I have to check my own suppliers as a supplier?
Not under NIS2. Your customer can require it contractually, though, typically for subcontractors with access to its systems or data. Check separately whether other regulations, such as the GDPR, create obligations of their own.
