Why you are getting these now
The NIS2 Directive widens the list of organisations that must manage cyber risk, and expects them to check their suppliers. DORA has applied since January 2025 to banks, insurers and other financial entities, and makes them manage the risk from their ICT providers. You may not be covered directly, but your customer is, so the questions arrive in your inbox.
What they usually ask
- Multi-factor sign-in for staff and administrators.
- Backups, and when you last tested a restore.
- How quickly you apply security updates.
- How fast you would tell them about an incident, and who would.
- Which subcontractors and cloud services touch their data, and where it is stored.
- Policies: information security, access control, incident response.
- Certifications or reports, such as ISO/IEC 27001.
Build one evidence pack
Collect screenshots, policies and short statements once, date them, and keep them in one folder. Most answers then take minutes. An AuditGlass passport with its verify link is accepted by many buyers as a summary, with the pack behind it for detail.
Answer honestly, with dates
Buyers expect gaps in smaller suppliers. What they need is to know where the gaps are and when they close. “Partly: MFA is on for administrators; all staff by 30 November” is a good answer. A yes that falls apart when they ask for evidence is not.
Read the contract clauses too
The questionnaire is often followed by contract terms: incident notice within 24 or 72 hours, audit rights, exit plans. Check you can meet them before you sign, and push back on timelines you can’t keep.
Sources
General information, not legal advice. For your own situation, ask a panel expert.
