What NIS2 means for you if you supply a large company

The scenario in brief

Example, made up for illustration. A fictional SME of twelve people has maintained the printers and copiers of a large group for years. One morning, the customer's purchasing department sends a spreadsheet of 80 IT security questions, to be returned within thirty days, with one sentence in bold: ‘As part of our NIS2 obligations’. The managing director has never heard of NIS2. He wonders whether he is now subject to a law he knows nothing about.

The short answer: not necessarily. But his customer is, and the law requires it to make sure its suppliers are not a way in for attackers. That route, the contract, is how NIS2 reaches most SMEs.

Why your customer is asking you these questions

NIS2 is a European directive on cybersecurity. In Belgium, it was transposed by the law of 26 April 2024, in force since 18 October 2024, and the Centre for Cybersecurity Belgium (CCB) is the authority in charge. It mainly targets organisations with at least 50 full-time employees, or with turnover and balance sheet total above 10 million euros, in listed sectors: energy, health, transport, manufacturing, digital services and others.

Among the minimum measures these organisations must take, the directive (Article 21) spells out ‘supply chain security’, meaning the security of their relationships with their direct suppliers and service providers. They must take into account the weaknesses specific to each supplier and the quality of its security practices. The directive's recitals go further: these organisations are encouraged to build cybersecurity measures into their contracts.

The CCB puts it simply on its NIS2 page: an organisation outside the scope of the law may still have to apply cybersecurity measures ‘because of a contractual requirement’, because it is part of the supply chain of a NIS2 entity.

The timetable explains the rush. According to the CCB, essential entities following the Belgian CyberFundamentals framework at the Basic or Important level had until 18 April 2026 to have their measures checked by an independent body. As supply chain security is one of the minimum measures in the law, these organisations are now turning to you.

The three forms the request takes

• A security questionnaire. Often a spreadsheet with dozens of questions: multi-factor authentication, backups, updates, incident handling, staff training.
• Proof. A recognised label or certification, such as the CyberFundamentals label or ISO 27001 (an international standard certifying that a company manages its IT security methodically, checked by an external auditor), which sometimes exempts you from part of the questionnaire.
• Clauses in the contract. A deadline for reporting an incident, a right to audit, rules on your own subcontractors, what happens to data at the end of the contract.

All three can arrive together, when a contract is renewed or during a tender. A vague answer can be enough to rule you out: the customer must be able to show that it has assessed its suppliers.

The questionnaire: what you will really be asked

Every customer has its own template, but the topics follow the minimum measures listed in the directive. Here are the questions that come up most often, and what you need to be able to show.

Multi-factor authentication, listed first, means asking for a code or an approval on your phone on top of the password: a stolen password is no longer enough to get in.

The golden rule: answer truthfully. A ‘yes’ you cannot back up makes your company liable if an incident occurs. Better to write ‘partly, in progress, planned for March’ than a ‘yes’ you cannot prove. A customer knows an SME does not have the resources of a bank; above all, it expects honesty and a dated plan.

Keep your answers in a single document, with the proof alongside. The next customer's questionnaire will largely cover the same topics.

The clauses to read before you sign

To see what these clauses look like, the most detailed European text is Implementing Regulation 2024/2690. It applies to the digital providers covered by NIS2, such as hosting companies and managed IT service providers, and gives a good idea of what large organisations ask for. It provides that contracts with suppliers specify, where appropriate:

• the cybersecurity requirements imposed on the supplier;
• the training requirements and, where relevant, certification of its staff;
• background checks on those staff;
• the obligation to report without undue delay any incident that threatens the customer;
• the right to audit, or the right to receive audit reports;
• the handling of security vulnerabilities that may affect the customer;
• the rules on your own subcontractors and what is expected of them;
• what happens at the end of the contract: return and destruction of information.

Before you sign, look at three points. The reporting deadline: ‘without delay’ is workable; ‘within the hour, day and night’ rarely is for a small team. The right to audit: who pays, with how much notice, how many times a year. Liability: a clause that makes you liable for all of the customer's losses after an incident deserves a review by your lawyer and a call to your insurer.

If you process personal data for your customer (customer files, staff records, patient data), the GDPR already requires a processing contract (Article 28) and obliges you to notify your customer of any personal data breach ‘without undue delay’ (Article 33). NIS2 clauses often supplement that existing contract.

What level to aim for: CyberFundamentals

The CCB advises any organisation that may be in the supply chain of a NIS2 entity to apply at least the Basic level of the CyberFundamentals framework (CyFun), the list of security measures published by the Belgian government. It adds that a NIS2 entity could theoretically impose a CyFun level on its direct suppliers.

The path to the label follows four steps published by the CCB: choose your level with the selection tool, complete the self-assessment and fix the gaps, have everything checked by an accredited conformity assessment body, then apply for the label on the Safeonweb@Work portal. A new version of the framework came out in October 2025; the 2023 and 2025 versions coexist until 18 April 2027.

The label is not necessarily the first step, unless a customer requires it. Completing the Basic self-assessment, even without an external check, already gives you most of the answers to your customers' questionnaires.

What to do on Monday morning

1. List your customers that are, or may be, subject to NIS2: large groups, hospitals, energy, transport, manufacturing.
2. Appoint one person to handle questionnaires and answers centrally, with help from your IT provider.
3. Turn on multi-factor authentication for email and all remote access: it is almost always the first question.
4. Test a backup restore and note the date and the result.
5. Write your incident procedure on one page: who to call, who tells the customer, and how quickly.
6. Download the CyberFundamentals self-assessment at Basic level and fill it in honestly.
7. Review your contracts, current and upcoming: reporting deadline, audit, liability, end of contract.

NIS2 can look like a matter for large companies. For a supplier, it is above all a chance to put in place measures that protect it too, and to reassure customers who matter.

Prepare your answers to customers→