You have just finished your first client's security questionnaire. Hours spent searching for who is responsible for the firewall, what password policy you actually use, and whether or not there is a backup procedure on paper. Then three months later a second client arrives with a similar list, and it feels like you are starting from scratch again. That does not have to be: the difference between the first and second questionnaire is not how fast you type, but whether you documented something the first time that you can refer back to.
Security questionnaires from different clients overlap significantly. An installation company that supplies to both an energy network operator and a healthcare institution receives questions that are eighty percent identical: is there a person responsible for information security, how do you handle access to systems, what do you do in case of an incident, how often do you test backups. The wording differs per client, but the underlying question does not. Those who put the answer the first time only in an email to that one client must look it up again the second time. Those who record the answer as part of a file copy it and adjust the wording.
What actually changes the second time
The core of every questionnaire — what measures are in place, who owns them, what evidence goes with them — changes little from one client to the next. What does differ is the question format: one client asks about 'access control', another about 'identity and access management', and a third wants a yes/no answer where the first asked for a three-sentence explanation. That is precisely the part that need not take much time if the underlying information is already in order. You rewrite the wording, not the content.
There is one important exception: if something in your organization has changed between the first and second questionnaire — a new supplier, a different backup system, a changed responsible person — that is the moment to update the file, not the questionnaire itself. A file that does not keep up with reality creates delays again with the third or fourth client, because then you still have to check what still applies and what does not.
The difference between answering a questionnaire and maintaining a file
A questionnaire is a snapshot for one client. A file is a living overview of the measures your organization has already taken, regardless of who is asking: what status does each measure have, what evidence goes with it, and who in the organization owns it. Once that overview exists, every questionnaire that arrives is essentially an export in a different order. review the ten due diligence measures per situation provides a picture of which components usually appear in them, even if your organization is not directly subject to NIS2 obligations but is affected through a client.
This distinction is also where time savings come from for organizations that are not themselves subject to obligations — the large group of SME suppliers affected through the due diligence obligation of their client. They do not need to implement a law, but do need to repeatedly demonstrate that basics are in order. Those who answer the first time as a separate email do the same amount of work with the second client. Those who record it as a file see the work per additional client decrease rather than stay the same.
Where the line lies
A dossier and the answers prepared from it do not replace the assessment conducted by the customer, nor are they a guarantee that the next questionnaire will be handled without additional questions — each customer assesses for themselves what is sufficient. A dossier also does not replace an audit, penetration test, or certification; that remains the work of specialized parties. What it does do is keep the repeated question 'how is this arranged at your organization' ready to hand, so you don't have to figure it out from scratch each time.
Whether your organization is affected through a customer or falls directly under the Cyberbeveiligingswet is something you can determine with a few questions via the NIS2 check that provides an indication in a few minutes. That check is free and can be completed without an account, just like the explanations on each topic in the knowledge base. The dossier itself, with the status per measure, the evidence, and the prepared answers for the next questionnaire, is part of the subscription — you can view exactly what is included here.
If you want to know where the information on the platform comes from and how it is maintained, you can read that on the page that explains where the information comes from. For your own situation — which questions a specific customer may ask and how far they may go — it remains advisable to consult a legal advisor or the competent supervisory authority if in doubt; the dossier prepares, it does not assess on your behalf.
Start with the question of where your organization actually stands: the NIS2 check provides an indication for that in a few minutes, without needing an account.