If you sell software, hosting, IT services, or anything else to companies in the EU, you may soon get an email titled "Supplier security questionnaire". The reason is NIS2, the EU's updated Network and Information Security Directive. It does not only regulate large operators of power grids or hospitals. It also pushes them to manage the security of their suppliers.
Where NIS2 stands in 2026
NIS2 entered into force in January 2023. EU countries had to turn it into national law by 17 October 2024. Most were late: the Commission opened infringement procedures against 23 member states in November 2024 and sent reasoned opinions to 19 in May 2025. Since then most countries have completed the job. Germany's law, for example, took effect on 6 December 2025, and one tracker reports that by May 2026 23 of 27 member states had transposed the directive by the Commission's own count. A few were still finalizing.
In January 2026 the Commission also proposed targeted amendments to NIS2 to clarify scope and reduce the burden, including for smaller companies. As proposals can change, check the current text for your country.
How it reaches you
The directive requires essential and important entities to take security measures that include supply-chain security. A covered customer cannot simply assume that you are secure. They have to assess suppliers and write expectations into contracts. In practice you will see:
- a questionnaire before onboarding or at renewal,
- contract clauses on incident notification, audits, and sub-suppliers,
- sometimes a request for a certificate such as ISO 27001, or a summary of your controls.
The questions you will probably get
- Multi-factor authentication on admin accounts, email, and remote access.
- Patching: how fast do you fix known vulnerabilities?
- Backups: are they tested, and is one copy offline or immutable?
- Incident contact: who do we call, and how quickly will you tell us?
- Access control: least privilege, and removal of leavers.
- Logging: can you investigate what happened?
- Encryption of data in transit and at rest.
- Sub-suppliers: who else handles our data?
The reporting clock matters here. A covered customer must give an early warning within 24 hours, a notification within 72 hours, and a final report within a month. To meet that, they will want to hear from you early.
A first-month plan for a small company
Week 1: Write it down. A two-page security policy that names an owner and an incident contact. Draft is better than none.
Week 2: Fix the big three. Turn on MFA everywhere it exists. Enable automatic updates. Check that backups restore, and keep an offline copy.
Week 3: Know what you have. List your systems, vendors, and where customer data lives. This also answers the sub-supplier question.
Week 4: Practice. Run a one-hour exercise: "We found ransomware at 2 a.m. Who does what?" Note the gaps.
Then keep a short evidence folder: screenshots of MFA settings, the backup test log, the policy, and a list of sub-suppliers. It turns the next questionnaire from a week of work into an hour.
Why this is not just paperwork
The week's incidents show why customers ask. A poisoned update from a trusted vendor reached thousands of servers, and a fake IT call exposed millions of records. In both, the weak link was a trusted party. NIS2 is the law's response to exactly that pattern.
Sources
Overview as of November 5, 2026. National rules differ. This is not legal advice.