Not in scope yourself, but your customer requires NIS2

This page is for companies that are not in scope of NIS2 themselves but receive questionnaires, contract clauses or requests for evidence with a NIS2 reference from their customers. The other side, how an in-scope entity assesses its suppliers and which questionnaire it sends, is covered on the page on supply chain security. German law calls in-scope organisations essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen).

Are you really out of scope?

Settle this first, before you answer a questionnaire as a “supplier”. An organisation can be in scope if it carries out an activity listed in Annex 1 or 2 of the BSIG and has at least 50 employees or both turnover and balance sheet total above €10 million; figures of linked enterprises count. Suppliers from manufacturing can themselves fall under Annex 2, for example in machinery, electrical equipment or motor vehicle parts. IT service providers that install, manage, operate or maintain their customers’ systems can be managed service providers under Annex 1. The check is set out on the page on NIS2 applicability, the position of IT service providers on the page on IT service providers and MSPs.

If you are in scope, you have obligations of your own under the BSIG, whatever your customers ask for. The rest of this page applies to companies that have checked their applicability and concluded they are out of scope.

Why is your customer asking about NIS2?

Under Section 30(2) sentence 2 no. 4 BSIG, essential and important entities must take measures for “supply chain security, including security-related aspects of the relationships with direct suppliers or service providers” (our translation). The explanatory memorandum quoted by the BSI (Federal Office for Information Security) gives examples: contractual agreements with suppliers and service providers on risk management measures, on handling cyber security incidents and on patch management, as well as observing principles such as security by design and security by default. The entity should take into account the vulnerabilities of its direct suppliers and the quality of their cyber security practices, including the security of their development processes (as also stated in Article 21(3) of the NIS2 Directive).

The BSI makes clear: the BSIG does not oblige all suppliers and service providers. To meet their own obligations, however, entities must commit their suppliers to corresponding security requirements. For your customer, whether to keep working with a supplier that gives no reliable answers can therefore become a business decision.

For some digital entity types, such as cloud providers, data centre operators and managed service providers, it gets more specific: Implementing Regulation (EU) 2024/2690 requires them to have a supply chain security policy and names contract contents, including the provider’s duty to report without undue delay security incidents that pose a risk to the customer’s systems. If you supply such companies, questions about incident notification are particularly likely.

What can your customer require by contract?

What you owe follows from your contract, not from the BSIG. In negotiations, your customer can ask for almost anything; you decide what you commit to. The table separates where a requirement comes from:

The right-hand column is our own professional assessment. We do not assess liability, contractual penalties, termination rights or indemnities; have such clauses reviewed by a lawyer.

How do you answer a supplier questionnaire?

A questionnaire is answered well when every answer fits the service provided, describes the actual status and is backed by evidence. This is how we approach it:

1. Define the scope: which service do you provide for this customer, and which of your systems, data and people does it touch? A parts manufacturer exchanging drawings answers different questions than a service provider with remote access.
2. State your own classification first: say that you have checked your applicability under Section 28 BSIG and with what result. That saves follow-up questions.
3. Choose a yardstick: the BSI recommends that suppliers who are not in scope check their own compliance with the measures in Section 30(2) BSIG for agreements with their customers. The ten areas of Section 30(2) therefore work well as the structure of your standard answers; an overview is on the page on Section 30 BSIG.
4. Be honest about the status: implemented, partly implemented or planned with a date. An answer “planned by March 2027” is more useful to the customer than a “yes” that does not hold up when asked.
5. Assign evidence: for every answer, a document, report or log that you can present on request or make available for inspection.
6. Approve and maintain: management approves the answers. Keep one master version and adapt it per customer instead of writing every questionnaire from scratch.

There is no standard question catalogue. The BSI welcomes efforts by industry to develop one and, for orientation, refers to the UP KRITIS best-practice recommendations on requirements for suppliers. A questionnaire from the entity’s side to download is on the page on supply chain security.

Which evidence is appropriate?

There is no “NIS2 certificate”, even if the term appears in requests. The BSI states explicitly that there is no general certificate for the supply chain requirement. Appropriate evidence fits the service and the risk for the customer. Suitable evidence examples, from lean to extensive:

Our recommendation: offer inspection of confidential documents instead of sending them, for example in a video call or at a meeting. Network diagrams, vulnerability reports and contingency plans do not belong in a questionnaire attachment.

Excessive requirements and how to answer them

Some requirements go beyond what a small supplier can deliver or should commit to at all. The suggested answers below are our professional assessment, not legal advice:

Example: a parts manufacturer answers a supplier questionnaire

Fictitious example, not a client. A contract manufacturer of milled parts has 34 employees, €4.8 million turnover and belongs to no group. A machinery manufacturer that has classified itself as an important entity sends it a supplier questionnaire. The contract manufacturer receives drawings via the customer’s supplier portal, sends questions by email and has no access to the customer’s network. An external provider manages its IT. Its answer looks like this (all values fictitious):

It comes with a short cover note that the contract manufacturer uses for all customers:

“We have checked our applicability under Section 28 BSIG and are neither an essential nor an important entity. We know that, as an in-scope entity, you must ensure the security of your supply chain, and we answer your questionnaire with reference to our service for you. Where a measure is not yet fully implemented, we give the date. We are happy to show you the evidence listed in a joint meeting.”

The answer commits only to what the company can prove and makes gaps visible with a date. It deliberately contains no commitments on liability or contractual penalties; those belong in the contract negotiation.

Three typical gaps on the supplier side

How we help

We help suppliers build a reliable master answer, prepare the matching evidence and assess technical and organisational requirements from customers. Have the contract clauses themselves reviewed by a lawyer. If the check shows that you are in scope yourself, the NIS2 gap analysis shows where you stand.