Ten pitfalls of the NIS2 supplier questionnaire
What NIS2-regulated partners ask their suppliers, and the mistakes we see most often in the answers.
3 November 2026 · P1R4T3 Research
Under NIS2, regulated organizations must also manage the security of their supply chain. In practice this means a supplier security questionnaire or contractual controls, even for smaller companies that are not regulated themselves. These are the ten mistakes we see most often.
1. Answering yes without evidence
The questionnaire is a signed statement. If an incident later shows that an answer was not true, it becomes a contractual and trust issue. Only mark yes what you can support with a document, screenshot or log.
2. Backups that were never restored
Having backups is not the same as being able to recover. Partners increasingly ask about the latest restore test. Have a documented test, and an offline or immutable copy.
3. MFA on only some accounts
The question is usually not whether you have MFA, but whether every account has it, especially administrator and remote access accounts. A single admin account left as an exception is the most common critical finding.
4. Forgetting the external IT provider
Supply chain security applies to you too: who can access your systems from outside, with which account, with or without MFA, and what the contract says about it. The IT service provider and the machine vendor's remote maintenance are typically missing from the answers.
5. No hardware and software inventory
You cannot protect and patch what you do not know about. A simple, up-to-date list is enough to start: devices, operating systems, critical software and owners.
6. Leavers' accounts stay active
You may be asked how quickly a departing employee's access is revoked. A leaver checklist that closes accounts on the same day is a simple and easily demonstrable control.
7. Incident handling exists only in people's heads
Who calls whom, who decides on shutting systems down, and when must the partner be notified? Contracts often set short reporting deadlines. A one-page printed incident sheet already helps a lot.
8. Missing e-mail authentication
Without SPF, DKIM and DMARC it is easy to send fake e-mails in your company's name, for example with a fraudulent invoice. A partner can check this from outside with a single lookup, so it is worth fixing early.
9. Training that is not documented
If awareness training took place, keep an attendance sheet, the material and the date. "We told them" is not evidence.
10. Treating the questionnaire as a one-off task
Partners typically ask again every year or at contract renewal, and regulated organizations are audited every two years. Keep the answers and the evidence in one place and review them annually.
Where to start
Start with the controls that matter most and are easiest to demonstrate: MFA everywhere, a tested backup, e-mail authentication and a leaver checklist. Our NIS2 quick assessment covers all ten areas in one to two weeks, for a fixed fee. It is not an official audit; it prepares you for one.