Your customer is under NIS2. What they will ask you, the supplier

NIS2, Directive (EU) 2022/2555, applies to medium-sized and larger organisations of the types listed in its Annexes I and II, and to a short list of types regardless of size (Article 2). It also applies at any size in two more cases. One is an organisation of an Annex type that an EU country identifies under Article 2(2)(b) to (e), for example as the only provider in that country of a service essential to critical societal or economic activities. The other is an organisation identified as a critical entity under the Critical Entities Resilience Directive, (EU) 2022/2557 (Article 2(3)). A supplier below the medium-sized threshold is outside NIS2 unless one of those cases applies to it. Where Ireland stands, and who NIS2 will bind covers the size test.

The questions come from what the Directive requires of your customer once the customer's country has made the Directive part of its law. One of the security measures in Article 21(2) is supply chain security, which covers the security side of the customer's relationship with each direct supplier or service provider (point (d)). Article 21(3) requires the customer to take into account the weak points (vulnerabilities) specific to each direct supplier and service provider. It must also weigh the overall quality of its suppliers' products and cybersecurity practices, including their secure development procedures.

A customer cannot take your practices into account without asking about them. Recital 85 of the Directive says in-scope entities should be encouraged to write cybersecurity risk-management measures into their contracts with direct suppliers and service providers, and that they could consider risks from further down the chain. That is how a duty the Directive puts on your customer, through its national law, becomes a clause in its contract with you.

Two more articles shape the questions. Article 20 requires the customer's management body to approve the Article 21 measures and oversee them. The management body can be held liable for infringements of Article 21, and its members must follow training. Article 23(4) sets the customer's reporting deadlines for a significant incident. It must send its CSIRT (the national computer security incident response team) or its regulator (competent authority) an early warning without undue delay, and in any event within 24 hours of becoming aware of it. An incident notification must follow within 72 hours, and a final report no later than one month after the notification.

A customer cannot report what it has not been told. Where an incident starts in a supplier's systems, the customer's report depends on the supplier telling it. That is why the Irish and EU texts described below include a clause on incident notice.

EU countries had to adopt and publish their national laws for NIS2 by 17 October 2024 and apply them from 18 October 2024 (Article 41). Ireland has not done so. The NIS2 page of the National Cyber Security Centre (NCSC) says three things. The deadline has not been met. The earlier NIS1 rules still apply to the operators of essential services already designated under them. And the NIS2 registration and incident reporting portals will be available once the legislation is implemented. The page was last updated on 24 June 2025.

The European Commission sent Ireland a letter of formal notice on 28 November 2024 and a reasoned opinion on 7 May 2025. On 8 July 2026 it decided to refer Ireland, with Spain, France and the Netherlands, to the Court of Justice. It asked the Court to impose a lump sum and daily penalties until Ireland notifies the Commission that the Directive is fully transposed. The Commission's release says most Member States have complied.

On 7 October 2026 the Department of Justice, Home Affairs and Migration published the National Cyber Security Strategy 2030, which follows the second strategy of 2019. The Strategy records that in February 2025 the Joint Oireachtas Committee on Justice, Home Affairs and Migration published its report on the outline of the National Cyber Security Bill (the pre-legislative scrutiny of its General Scheme). It says the Department is working with the Office of Parliamentary Counsel and the Attorney General's Office on a draft of the Bill to bring to Government. The Law Society Gazette reported on 7 October 2026 that the Bill was included for priority publication in the Government's autumn legislative programme. Its general scheme was published in 2024. On 15 October 2026 the Oireachtas register of Bills for 2024, 2025 and 2026 contained no Bill with cyber in its title.

None of this stops the questions. A customer regulated in a Member State that has transposed NIS2 is bound there now, and its supply chain measures reach an Irish supplier through the contract.

For some digital providers, the EU country whose law applies is the one where the provider has its main establishment. That is where its cybersecurity risk-management decisions are mainly taken (Article 26(2)). These providers include cloud, data centre, content delivery, managed and managed security service providers, and the others listed in Article 26(1)(b). A provider whose main establishment is in Ireland falls under Irish jurisdiction, where NIS2 has not been transposed, even if it has offices in other Member States. The Strategy says Ireland will supervise the cloud and other digital service providers whose main establishment is in the State.

The groups below are built from two things, both described further down. One is the contract terms listed in the NCSC's draft guidance (RMM012.SA02), in point 5.1.4 of the Annex to Implementing Regulation (EU) 2024/2690, in DORA Article 30 and in GDPR Article 28. The other is the customer's own security measures, which it can pass on to you as contract requirements. They are not a statutory list. NIS2 gives a supplier no list of questions to answer, and each customer decides what to ask. In its January 2026 proposal to amend NIS2, the Commission said the supply chain duty has led many organisations to ask their suppliers for extensive information, through many different questionnaires, formats and processes.

ENISA, the EU's cybersecurity agency, has written guidance for the digital providers covered by the Implementing Regulation. Among the evidence a customer can weigh when it selects a supplier, it lists provider assessment reports, naming the Standardized Information Gathering and the Consensus Assessment Initiative Questionnaire.

The right-hand column says which text each group comes from: Directive articles, points in the Implementing Regulation's Annex, and measures in the NCSC's draft guidance, each described below. Some are the customer's measures for its own systems, such as two-step sign-in (multi-factor authentication) and backups. Those reach your systems only if the customer writes them into your contract as security requirements. Annex point 5.1.4(a) and RMM012.SA02 provide for that, under the supply chain measure in Article 21(2)(d). Multi-factor authentication on your own email, for example, is a requirement the customer may set. The texts cited require multi-factor authentication, where appropriate, for access to the customer's own systems, and that can include your staff signing in to them.

On certification, the NCSC's CyFun FAQ of June 2025 said Irish CyFun certification was expected by 2027. The Strategy 2030 now sets two targets. CyFun (Cyber Fundamentals) is to be approved (sanctioned) as a national voluntary certification scheme by Q3 2027, the step that lets certification bodies be accredited. Two accredited bodies are to be in place by Q4 2029. It says the scheme will give regulated and non-regulated entities a path to demonstrate security and resilience for supply chain and procurement requirements. The FAQ describes CyFun as a tool an organisation can use to assess its cyber security risk, and says it does not prove that an organisation meets its NIS2 obligations. For more on each, see CyFun, ISO 27001 and Cyber Essentials.

The NCSC published draft risk management measures guidance for NIS2 entities on 24 June 2025. The document is dated 4 June 2025, is marked draft, and says it remains in draft pending the final content of the National Cyber Security Bill. It is written for the organisations the Bill will regulate. Its supply chain measure, RMM012, describes the supplier side in detail.

RMM012 asks each organisation to keep an up-to-date register of its direct suppliers and service providers, with contact points and the systems, services or products each one provides (RMM012.FA03). It also asks the organisation to make sure, through service level agreements or audit, that suppliers keep adequate security measures in place, and that those measures stay appropriate and proportionate to the risk (FA04). It says the risks of systems a third party supplies remain the entity's own responsibility, even where the supplier fully manages them. And it asks the entity to review its suppliers' cybersecurity practices at planned intervals and after an incident related to their services (SA04).

Supporting action RMM012.SA02 lists the clauses contracts with direct suppliers should include, and says the list is not exhaustive:

Public service bodies have had guidance on this since June 2023, whatever the state of NIS2's transposition. The Guidelines on Cyber Security Specifications (ICT Procurement for Public Service Bodies), developed by the Department of the Environment, Climate and Communications and the NCSC, tell public buyers to set out the information security policies they require of a supplier. These cover, among other things, access management, security awareness, vulnerability management, and incident management and reporting obligations.

They tell buyers to set what the supplier must report, and how, when it becomes aware of a security vulnerability, incident or data breach. They tell buyers to include a right to audit where permissible, with access to security audit reports or an independent check (third-party attestation). And they tell buyers to state in the tender the cyber security certification they require.

Two points in them apply to any certificate you put forward. A certificate may cover some parts of a service and not others, and buyers are told to compare its scope with the service being bought. And a supplier that uses a certified outside service gains no certification rights from it. Where certification is required, the guidelines say each supplier must have its own accredited certification in place. A cloud provider's ISO 27001 certificate is evidence about the cloud provider.

For some digital entities the measures are set at EU level. Commission Implementing Regulation (EU) 2024/2690, adopted on 17 October 2024 and published in the Official Journal on 18 October 2024, sets out the technical and methodological requirements of the Article 21 measures for certain digital providers. They are DNS, TLD registry, cloud, data centre, content delivery and trust service providers, managed and managed security service providers, online marketplaces, search engines and social networking platforms. The NCSC's draft guidance tells those providers to follow the Regulation in place of most of its own measures.

Point 5 of its Annex covers the supply chain. The entity must have a supply chain security policy, choose suppliers against criteria that include their cybersecurity practices, and keep a register of its direct suppliers (points 5.1 and 5.2). Point 5.1.4 requires the provider to make sure its contracts with suppliers set out the following, where appropriate. The list is close to the NCSC's: cybersecurity requirements, staff training and where appropriate certifications, background checks, notice of incidents without undue delay, audit rights or audit reports, vulnerability handling, subcontracting, and obligations when the contract ends.

Point 8.1 requires the entity to ensure that its direct suppliers are aware of risks and apply cyber hygiene practices, and to offer them an awareness programme where appropriate. A supplier to one of these entities can therefore be asked to take part in its training.

ENISA published technical implementation guidance on the Regulation on 26 June 2025. It is guidance, not law. Among the supplier selection criteria it suggests are industry standard certifications, provider assessment reports, compliance statements from the supplier about NIS2, and the supplier's history of cybersecurity events and breaches. It says the point 5.1.4 terms should go into all relevant new and renewed contracts. It suggests further terms, including where data is processed and stored, with advance notice of any change. And it suggests reviewing the supply chain policy at least once a year.

Where the customer is a financial entity, the Digital Operational Resilience Act is the text behind the questions. DORA, Regulation (EU) 2022/2554, has applied directly in every Member State since 17 January 2025. It covers credit institutions (banks), payment and e-money institutions, investment firms, insurance undertakings and the other financial entities listed in Article 2, with exclusions in Article 2(3). Insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries that are micro, small or medium-sized are outside it (Article 2(3)(e)), and so are the insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC (Article 2(3)(b)). The NCSC's draft NIS2 guidance says it does not apply to financial entities covered by DORA.

The financial entity remains fully responsible for its obligations when it uses an ICT supplier (Article 28(1)(a)), and it must keep a register of information on all its contracts for ICT services (Article 28(3)). An ICT third-party service provider is any undertaking providing ICT services, meaning digital and data services provided through ICT systems on an ongoing basis (Article 3(19) and (21)). The definition has no size condition. DORA's direct oversight of ICT providers applies to those the European Supervisory Authorities designate as critical (Article 31). For a provider not designated, what DORA requires reaches it through the financial entity's contract.

Commission Implementing Regulation (EU) 2024/2956 sets the templates for that register. It requires the financial entity to identify each ICT supplier that is a legal person by a valid and active legal entity identifier (LEI) or its European Unique Identifier (EUID), and both where available. Individuals acting in a business capacity are excepted. Where the service supports a critical or important function, the subcontractors that underpin it must also use an LEI or provide their EUID. That is why a financial customer can ask you for either identifier.

Article 30(2) lists terms every such contract must include. Among them: a description of the services and, where the service supports a critical or important function, whether subcontracting it is permitted and on what conditions; the countries or regions where services are provided and data is processed and stored, with advance notice of any change; data protection; return of data on insolvency or termination; service levels; help in an ICT incident at no additional cost or at a cost set in advance; cooperation with the entity's regulators; termination rights; and the supplier's participation in the entity's security awareness training.

Where the service supports a critical or important function, Article 30(3) adds precise performance targets, tested business contingency plans, participation in the entity's threat-led penetration testing, unrestricted rights of access, inspection and audit for the entity and its regulator, and an exit strategy with a mandatory transition period. A financial entity that is itself a microenterprise may agree with the supplier that its audit rights are exercised by an independent third party the supplier appoints.

The financial entity is required to have these terms, so it cannot leave them out of your contract. Their detail is open to negotiation, including service levels, notice periods and the price of incident help. Article 30(4) asks both sides to consider standard contract clauses that public authorities have developed for specific services. Credit unions are the exception in Ireland for now: S.I. No. 20 of 2025 provides that DORA does not apply to them until 17 January 2028.

GDPR Article 28 applies today, in Ireland, at any size. It covers the relationship between a processor (a business that handles personal data for another) and its controller (the business that decides why and how the data is used). Article 28(1) allows a controller to use only processors providing sufficient guarantees to implement appropriate technical and organisational measures. A security questionnaire is one way a controller tests those guarantees.

Article 28(3) requires a contract or other legal act. Under it, among other things, the processor takes the security measures Article 32 requires, makes available the information needed to show compliance, allows for and contributes to audits, including inspections, and deletes or returns the data at the end. Article 32 also binds the processor directly. Article 28(2) bars engaging another processor without the controller's prior written authorisation. Article 33(2) requires the processor to notify the controller of a personal data breach without undue delay after becoming aware of it. There is no fixed number of hours in it, and the controller's own 72 hours is a separate duty.

A customer under NIS2 that is also your controller can ask both sets of questions, and they overlap: security measures, audit, incident notice, sub-suppliers and exit appear in both. For the GDPR as a whole, see the GDPR for a small Irish business.

The points below are for a supplier NIS2 does not cover. That means one below the medium-sized threshold or outside the sectors in its Annexes, not of a type it covers at any size, and not identified by an EU country under Article 2(2)(b) to (e).

The questions repeat across customers in different forms. Keep one evidence pack up to date and fill each questionnaire from it. That keeps the answers consistent from one customer to the next.

Hold it to the test the NCSC applies to a substantiated CyFun statement of applicability: there must be evidence that a control is implemented and is effective. A yes with nothing behind it fails that test.

The texts also give a supplier a point to raise when a request is out of scale. NIS2 Article 21(1) requires measures that are appropriate and proportionate, weighing the organisation's exposure to risk, its size, and the likelihood and severity of incidents. RMM012.FA04 asks the customer to keep supplier measures appropriate and proportionate to the risk. The Commission's proposal says these requests can create a significant administrative burden for suppliers. None of this lets a supplier refuse a question. It is grounds to ask the customer to limit the questions to the service you supply, and to set a notice window you can meet.

The customer is told to review its suppliers at planned intervals and after incidents (RMM012.SA04, and point 5.1.6 of the Implementing Regulation's Annex), so the same answers will be read again. Date the pack, and review it at least once a year and whenever a sub-supplier, a data location or an incident changes an answer. What to keep in it:

Two things bind you directly today. The first is GDPR Articles 28, 32 and 33(2), where you process personal data for the customer. The second, if you make software or a connected product that is made available on the EU market, is the reporting duty in Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, which has applied since 11 September 2026 (what it requires; whether it covers SaaS). Binding you through the contract: DORA's required terms where the customer is a financial entity, and whatever else you have signed. The rest is still to come.

In its proposal of 20 January 2026 to amend NIS2, COM(2026) 13, the Commission says it should develop guidelines recommending the level of detail, structure and format for the supply chain information organisations ask suppliers for. Its explanatory memorandum says the aim is to ensure legal certainty and to stop obligations being unduly passed on to organisations NIS2 does not cover. It is a proposal and binds nobody until the European Parliament and the Council adopt it. On 15 October 2026 the Parliament's procedure file showed it awaiting a committee decision, with a draft report from the lead committee dated 24 September 2026.

The Strategy 2030 also commits the NCSC to an ICT Supply Chain Security Action Plan. It says the NCSC will develop targeted supports for SMEs to help them navigate the cyber security risk management obligations of their customers, and that particular attention will be paid to ensuring supply chain expectations do not become a barrier to participation.