NIS2 puts the supply chain duty on your customer. Then your customer passes it straight to you. Covered entities have to treat supply chain security as part of their cybersecurity risk management. In practice, they send their IT suppliers questionnaires and new contract clauses. Expect questions on seven topics, and expect them to want a document behind each answer:
- Your written security policies
- Incident handling: who responds, and how fast you tell them
- Who can access their systems and data
- What you log, and how long you keep it
- How you find and patch vulnerabilities
- Which subcontractors touch their data or systems
- Which certificates or audit reports you hold
If you skip a control, they will want the reason on paper. Managed IT and cloud firms face one big exception to the "duty sits with the customer" rule, covered in the next section.
I do not do compliance work, and nothing here is legal advice.
What I can add is the sales side. A sale rarely starts and ends in an inbox. In a NIS2 sector the buyer's vetting arrives as a form with a deadline, read by a security lead who never saw your demo.
What does NIS2 require on supply chain security?
The European Commission's NIS2 page describes the directive as a single legal framework for cybersecurity across 18 critical sectors. The same page says that, as a rule, medium-sized and large entities in those sectors must take appropriate cybersecurity risk-management measures and notify national authorities of significant incidents.
The EUR-Lex summary of the directive names supply chain security as one of those measures and requires them to be proportionate. The entity's management body must approve the measures and oversee them, and it can be held liable for infringements. That helps explain the careful tone of the questionnaires you receive: someone senior on the customer side now answers for the suppliers the company keeps.
In the directive itself, the supply chain duty is Article 21(2)(d). Article 21(3) tells entities to weigh each direct supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices, and its secure development procedures.
For the digital infrastructure, ICT service management and digital provider sectors, the technical detail sits in Implementing Regulation (EU) 2024/2690, adopted in October 2024. It sets technical and methodological requirements, tells entities to weigh their size and the likelihood and severity of incidents, and draws on standards such as ISO/IEC 27001 and ISO/IEC 27002.
One rule in that regulation shapes what customers will ask you. When an entity does not apply a requirement marked "where appropriate", "where applicable" or "to the extent feasible", it must document its reasoning. Your gaps become their paperwork.
Check one thing before you read further. The directive's annexes list managed service providers, managed security service providers, cloud computing providers and data centre operators among the covered sectors. A medium-sized or larger supplier that runs customers' IT may therefore carry duties of its own, on top of any questionnaire.
The definitions are wide. Article 6 of NIS2 defines a managed service provider as an entity that installs, manages, operates or maintains ICT products, networks, infrastructure, applications or other network and information systems, on site or remotely. A managed security service provider is a managed service provider that carries out or assists with cybersecurity risk management. Ask your lawyer which national law applies to you. If you are a managed service provider yourself, how IT service firms win clients with outbound covers the sales side.
Who sends the questionnaire, and who decides?
The person who wanted your service is usually an IT, operations or engineering manager. Under NIS2 they rarely approve you alone. Expect these four groups to touch your file:
- Procurement or vendor risk, who sends the questionnaire and chases the deadline
- The CISO or security lead, who scores your answers
- Legal, who turns the findings into contract clauses
- The management body, which signs off and carries the liability
Most sales teams build a relationship with the first person and meet the other three only when the deal is already late. Fix that before your next campaign. Open your CRM, go through the deals you won or lost in regulated sectors, and write down who actually approved or blocked each one.
If those names belong to security and procurement leads nobody on your team ever wrote to, put them in the campaign from day one. They should hear from you before the questionnaire, while you are still a name with a clear offer. If security is also the product you sell, outbound for cybersecurity companies covers the outreach side of reaching security teams.
Which suppliers do customers scrutinize first?
Customers rank suppliers by how much damage a failure on your side would do to them. Score yourself on three signals:
| Signal | High | Low |
|---|---|---|
| Access | Remote or admin access to their networks or systems | No access to their environment |
| Data sensitivity | You process or store their operational or personal data | You never see their data |
| Operational dependency | Their service stops when yours does | They could replace you within a week |
What the score usually means for you:
- High on two or three signals: a full questionnaire, and audits for the riskiest suppliers
- High on one: a shorter form
- Low on all three: a contract clause, sometimes with a self-declaration
Run this score before you plan outreach. A managed hosting firm and a training provider can sell to the same utility, and they need very different first messages.
Where are the buyers who will send these questionnaires?
Start with the customers you already have. Mark every current customer that sits in a NIS2 sector. Those contracts will come back at renewal with security clauses attached, and a ready pack helps you keep them.
Then build lookalikes: same sector, same country, same size as the customers who already pay you. That list is finite. In many sectors and countries you can count the operators by hand, so your offer has to make sense to the whole list. For how we build and verify lists like this, see our lists and targeting FAQ.
Country matters because NIS2 works through national law. The Commission's NIS2 transposition page shows a state of play built from what member states report. In 2025 the Commission issued a reasoned opinion to 19 member states over incomplete transposition, giving them two months to respond and take the necessary measures.
The same transposition page records that on 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU.
The country pages for Latvia and Bulgaria, for example, each record a reasoned opinion dated 7 May 2025. These pages show where a country stands. None of them sets rules for suppliers.
Expect questionnaires earlier where national law is in force and the authorities are named, and later where a country is still answering the Commission. Recheck the country page before you quote a status in a proposal. A stale date in front of a security team costs you credibility on the first page.
What evidence will customers ask for?
Customers word these differently, but these are the questions to expect. From your side of the table, each question has an answer that closes it:
| What the customer asks | What closes the question |
|---|---|
| Do you have documented security policies? | A policy index with an owner and a last-review date for each policy |
| Who do we call in an incident, and how fast will you tell us? | A named contact, a deputy, a 24/7 route and your notification commitment |
| Who at your company can access our systems or data? | A role list, multi-factor login and your joiner and leaver process |
| What do you log, and for how long? | Your log sources and retention periods |
| How do you handle vulnerabilities? | Patch timelines by severity and the date of your last test |
| Which subcontractors touch our data or systems? | Name, country and role for each one |
| Can you show independent assurance? | A certificate or audit report with its scope, or a dated plan |
| Which controls do you skip, and why? | An exception log with a reason, an owner and a review date |
The last row mirrors the documentation rule in the implementing regulation. Hand over your own reasoning and the customer's file gets easier to complete.
ENISA's technical implementation guidance, published on 26 June 2025, supports the requirements of Implementing Regulation 2024/2690 and was written for the same three digital sectors. It offers practical advice, examples of evidence and mappings of the security requirements. Those evidence examples are the part to study. Read them to see what proof looks like to a security reviewer, so you can send files instead of promises.
The NIS Cooperation Group publishes non-binding guidelines for member states. They include a toolbox to improve ICT supply chain security and a reference document on security measures for NIS2 entities, with a mapping table. Use both as a format guide for your answers. What you owe a specific customer is set by your contract.
The supplier evidence pack: what to put in it
Deal sizes make this worth the effort. Suppliers like the ones we work with often sell contracts worth six or seven figures, and one deal stuck in a security review for a quarter costs more than the few days a pack takes to build.
The minimum pack:
- A one-page security overview in plain words
- Incident contact: a named person, a deputy, email and phone
- A policy index with titles, owners and review dates
- A control summary: one answer per question in the table above, two lines each
- Assurance evidence: certificate and scope, or your latest test summary
- A subcontractor list: name, country and what each one touches
- An exception log: control, reason, owner, target date
A worked example (hypothetical). Take a 60-person software company that hosts a scheduling application for an EU energy utility. Its pack looks like this:
- Overview: the hosting region, encryption in transit and at rest, and the 4 engineers with admin access, all on multi-factor login
- Incident contact: the head of operations, with a deputy and a shared mailbox; the company commits to inform the customer within 24 hours of detection, a timeline it chose itself
- Assurance: an ISO/IEC 27001 certificate covering hosting and support; the overview states that the sales office sits outside that scope
- Subcontractors: the cloud host and one external penetration testing firm
- Exception log, one line: "No 24/7 security operations center. Reason: 60 staff; an on-call rota covers nights. Owner: CTO. Review: Q1 2027."
Add the policy index, log sources with retention, and patch timelines by severity. Now every row of the customer's table has an answer.
How do you turn the pack into a sales advantage?
If your deals keep stalling after a good first meeting, look at your packaging before you buy more leads. The leak is often in the packaging. For a supplier to a NIS2 customer, that means how cleanly your proof is presented.
Here is how I would use the pack across the sales process:
- In the first message to the IT buyer, sell the meeting. Give NIS2 one line: the pack exists, and here is what it covers. A first email that explains the directive gets ignored.
- Write to the security lead separately and offer the pack itself. They score your answers, so a document speaks to them better than a demo does.
- Fix your team's LinkedIn profiles and add a short security page to your website. Security and procurement leads look you up before they reply. If all they find is a job title and a photo, you lose them in seconds.
- Bring the pack to the first call. Booking the call and closing the deal are two different things, and the pack is what carries you from one to the other. When the questionnaire arrives, much of it is already answered.
A first message to a security lead can be this short:
Hi [first name], we run [service] for [2 similar customers in your sector]. When their security teams sent NIS2 supplier questionnaires, we answered from a pack we keep ready: control summary, certificate scope, subcontractor list and exception log. Happy to send it ahead of a 20-minute call if your team is reviewing suppliers this year.
Channel depends on the country. My team mostly runs campaigns into the US, the UK and English-speaking Europe. The exceptions are Germany, Austria and Czechia, where a compliant legal basis has to exist before any cold email goes out. For those buyers I would start on LinkedIn.
Germany is not our specialty. When a client needs it, our own stricter compliance rules apply. For how this fits managed IT and consulting firms, see outbound for IT services and consulting companies.
How do you answer a security questionnaire in writing?
One short email with attachments does the job. An example with made-up names:
Subject: Your supplier security questionnaire - our response
Hi Marta, thank you for sending this. In short: we meet every control on your list except one. Attached are our control summary, our ISO/IEC 27001 certificate with its scope, and our subcontractor list. The open item is quarterly restore testing. Our CTO, Pavel Novak, owns it, and it will be in place by 31 January 2027. Pavel is your contact for anything deeper at security@ourcompany.com, and he is happy to join a short call with your security lead.
The rule behind it is simple. Attach proof for every control you can show. For anything you cannot show yet, say it is in progress, name the owner and give a date. Never answer yes to a control you cannot evidence. The next email will say "please send it", and the deal goes quiet while you scramble. Fix the pack first. Then scale the outreach.
NIS2 is rarely the only EU rule in a supplier contract. If you ship software or connected devices, the Cyber Resilience Act guide covers the product-side obligations, and the Data Act post covers the data clauses that rule brings into supplier deals.
If a NIS2 questionnaire is holding up one of your deals and you want to talk through the pack and the first message, book a call. Bring the questionnaire you received.
Questions suppliers ask about NIS2 security reviews
Should I use intent data to find NIS2 buyers?
Only when your market is large. Intent data is one tool among many. Picture a niche of 900 companies in which intent signals appear on roughly 6 of them. Waiting for those 6 leaves 894 untouched, so we skip the signals and write one offer that fits the whole list.
What reply rate is realistic when emailing security and procurement leads?
In our campaigns, reply rates usually sit around 1%, and often 0.5% when volume reaches thousands of emails a day. Of those replies, 10% to 50% usually end in a booked meeting. The exception is a tightly targeted, heavily personalized campaign: those can reach 15% to 17% replies, and about 75% of the people who reply are interested. The bigger the volume, the lower every average.
How long before outbound to NIS2 buyers turns into revenue?
Meetings can come within the first 30 days of a campaign. Contracts come later. A B2B deal can take 6 to 12 months to close, and a security review adds another round of paperwork before anyone signs. A deal from a first-month meeting may close 4 or more months later, so judge the channel on pipeline, not month-one revenue.
Do customers in different EU countries ask for different evidence?
Sometimes. In the three digital sectors, the implementing regulation sets the detail at EU level. Customers in the other sectors take their detail from national law, so a utility in one member state and a hospital in another can word the same question differently. Keep one core pack and add a short country annex.
Is an ISO/IEC 27001 certificate enough on its own?
Often it is not. Reviewers read the scope statement first: which sites, teams and services the certificate covers. A certificate for your head office says little about the support team that serves the customer. They also check the expiry date, so always send the current certificate. If the scope misses the service you sell, expect the full questionnaire anyway.