A customer sends us a NIS2 vendor questionnaire, how do I fill it in smartly?

NIS2-scoped customers must control their supply chain. Questionnaires range from light (a few pages) to heavy (full assurance report). Honest and consistent answers beat ticking yes everywhere.

Try this first

1. 1Read the whole questionnaire first. Map which topics (ISMS, incident response, access control, BCM, vendor management) and at what depth.
2. 2Collect evidence internally. Policy, ISMS scope, recent pen test, breach procedure, sub-processor contracts, awareness training. You reuse this every time.
3. 3Answer honestly. A No with a roadmap beats a Yes without evidence. Customers probe and discrepancies hurt at audit.
4. 4Keep a central NIS2 vendor file. A managed version of the most-asked answers saves time every round.
5. 5Ask the customer which topics they prioritise. Sometimes only the incident-notification deadline is the cornerstone and the rest can be a growth path.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.