Why you are receiving this questionnaire
If your company supplies something to an organization that falls under the NIS2 Directive — an essential or important entity, such as energy companies, hospitals, major transport companies, or digital infrastructure — then that customer is required to assess its own suppliers. The Directive obliges that customer to map out risks in its supply chain, not just its own systems. This is described in what is often called the due diligence obligation, found in Article 21 of the Directive. The questionnaire you receive is the practical consequence: your customer must be able to demonstrate that it knows who its suppliers are and how they handle security.
It is important to understand: receiving a questionnaire does not automatically mean you yourself fall under the NIS2 Directive. Most companies that receive such a list are what is called supply chain affected — they do not fall under the law themselves, but they are confronted with it through a customer. You can check whether that applies to your organization, and what type of impact that is, using a short check that maps out your situation.
What is usually in it
The questionnaires currently circulating differ greatly depending on who created them — there is no mandatory format under the law. Still, certain topics appear almost universally. Questions about who within your organization is responsible for information security, whether you have a policy for handling incidents, how you manage access to systems, whether staff receive training, and whether you yourself set requirements for your own suppliers. Some lists additionally ask about certifications, previous incidents, or how you handle updates and remediation plans.
The underlying thinking is always the same: the customer is trying to get a picture of risks that could reach it through your supply. This is not distrust directed at your company specifically, but an obligation that the customer must itself meet. If you want to understand which ten measures serve as the basis here, you will find that explanation in the overview of topics per situation.
What a useful answer requires
A good answer to a security questionnaire is not necessarily one where you tick 'yes' to everything. Regulators and customers typically look for consistency: do your answers align with what you actually do, and can you back that up? A vague or overly optimistic response will generate more questions down the line than an honest answer that identifies an improvement point with a timeline attached.
It helps to have three things clear for each question: what the current situation is, who within your organization can confirm that, and what evidence document goes with it — a policy document, a screenshot of a setting, a training record. Companies that do not need to look up these three points from scratch for each question, but have already recorded them in an ongoing register, can typically complete a questionnaire within an hour instead of days. This is exactly what a dossier with status, evidence document, and owner per measure is intended for.
What you do not need to do
It is worth knowing that completing and submitting this questionnaire remains your own responsibility — a service can help you prepare and structure answers, but must never submit on your behalf to a customer or regulator. An audit, a penetration test, or a certification is something different from completing a questionnaire; that remains work for specialized parties, should a customer specifically ask for it.
If you doubt whether the questions you receive are reasonable in proportion to your size and role, that is a conversation best held directly with the customer, possibly with a lawyer if the requirements are contractually fixed. Secria describes what the Directive and national legislation say, but does not make judgments about individual contracts.
Look further
If you first want to know where this information comes from and how it is maintained, you can read about it on the page explaining how the platform works. If you do not yet have a clear picture of your own position in the supply chain, start with the free check — it provides an indication and a logical next step within a few questions, without requiring an account.