Free templates
Supplier security questionnaire
Send these questions to your important suppliers, as NIS2 Article 21(2)(d) asks for supply chain security. Each question says what a yes means.
How to use it
- 1Download the file for Excel, or print it.
- 2Fill in the empty columns with your team or your suppliers.
- 3Agree on owners and dates, and check again in a few months.
What is inside: 31 items
1.Do you have a written information security policy that is approved by your management?
Yes means a current security policy exists, is approved by management, is reviewed regularly and is known to your staff.
NIS2 21(2)(a) · ISO 27001 A.5.1
2.Have you named a person who is responsible for information security in your organization?
Yes means a named person, internal or external, is responsible for security, has management support and can be contacted by customers.
NIS2 21(2)(a) · ISO 27001 A.5.2, A.5.4
3.Do you identify and assess information security risks at least once a year and track how they are treated?
Yes means you follow a defined risk method, keep a risk register with owners and treatment, and update it at least yearly and after major changes.
NIS2 21(2)(a) · ISO 27001 A.5.1, A.5.7
4.Do you have a written incident response plan with roles, steps and contacts?
Yes means a current plan describes who does what when a security incident occurs, including escalation, containment, recovery and contact details.
NIS2 21(2)(b) · ISO 27001 A.5.24, A.5.26
5.Will you notify us within 24 hours of becoming aware of a security incident that affects our data or the services you provide to us?
Yes means you have a named contact and a process to warn us within 24 hours and to keep us informed until the incident is closed.
NIS2 21(2)(b) · ISO 27001 A.5.24, A.5.26
6.Do you log security-relevant events and monitor them to detect suspicious activity?
Yes means sign-ins, admin actions and security alerts are logged, logs are protected and kept for a set time, and someone reviews alerts promptly.
NIS2 21(2)(b) · ISO 27001 A.8.15, A.8.16
7.Do you record every security incident and use the lessons learned to improve your security?
Yes means each incident is documented with cause, impact and actions taken, and follow-up improvements are tracked until they are done.
NIS2 21(2)(b) · ISO 27001 A.5.25, A.5.27
8.Do you back up important data and systems regularly, with at least one copy kept offline or otherwise protected from ransomware?
Yes means backups run on a written schedule, cover cloud data too, and at least one copy cannot be changed or deleted from your normal network.
NIS2 21(2)(c) · ISO 27001 A.8.13
9.Do you test restoring data and systems from backups at least once a year?
Yes means restores are actually performed and timed at least yearly, and the results and any problems are recorded.
NIS2 21(2)(c) · ISO 27001 A.8.13
10.Do you have a tested plan for continuing or restoring the services you provide to us after a major disruption or crisis?
Yes means a continuity and crisis plan sets recovery times and responsibilities for these services and has been tested, for example in an exercise, within the last year.
NIS2 21(2)(c) · ISO 27001 A.5.29, A.5.30
11.Do you set security requirements for your own suppliers and include them in your contracts with them?
Yes means contracts with suppliers that handle data or services relevant to us include security, confidentiality and incident notification duties.
NIS2 21(2)(d) · ISO 27001 A.5.19, A.5.20
12.Will you tell us which subcontractors support the services you provide to us and inform us before you change them?
Yes means you can provide a current list of subcontractors involved in our services or data, including their location, and announce changes in advance.
NIS2 21(2)(d) · ISO 27001 A.5.21, A.5.19
13.Do you assess the security of your critical suppliers before contracting and regularly afterwards?
Yes means critical suppliers are checked, for example by questionnaire, certificate or audit, before contracting and at least every one to two years.
NIS2 21(2)(d) · ISO 27001 A.5.22
14.Do you install security updates within set times, with critical updates applied within days?
Yes means operating systems, applications and devices are patched on a defined schedule, critical fixes are prioritised and unsupported software is replaced.
NIS2 21(2)(e) · ISO 27001 A.8.8, A.8.19
15.Do you scan your systems for vulnerabilities regularly and fix findings within set times based on severity?
Yes means systems, especially internet-facing ones, are scanned regularly and findings are fixed within deadlines that depend on their severity.
NIS2 21(2)(e) · ISO 27001 A.8.8
16.If you develop or maintain software for us, do you follow secure development practices, including code review and security testing before release?
Yes means secure coding rules apply, changes are reviewed by another person and security tests run before release. Choose Not applicable if you do not develop software for us.
NIS2 21(2)(e) · ISO 27001 A.8.25, A.8.28, A.8.29
17.Do you have a process for receiving vulnerability reports and informing customers about vulnerabilities that affect them?
Yes means anyone can report a vulnerability to a published contact, reports are handled by a defined process and affected customers are told about risks and fixes.
NIS2 21(2)(e) · ISO 27001 A.8.8, A.5.24
18.Do you regularly check whether your security measures work, for example through internal audits or security indicators?
Yes means you check your measures by a plan, report results to management and track corrective actions until they are done.
NIS2 21(2)(f) · ISO 27001 A.5.35, A.5.36
19.Has your security been reviewed independently in the last three years, for example by an external audit, certification or penetration test?
Yes means an independent party reviewed your security or the systems used for our services, and you can share a summary, certificate or report on request.
NIS2 21(2)(f) · ISO 27001 A.5.35, A.8.8
20.Do all your employees receive security awareness training when they join and at least once a year?
Yes means everyone, including management, is trained on security basics at onboarding and yearly, and you keep records of who completed it.
NIS2 21(2)(g) · ISO 27001 A.6.3
21.Are your employees trained to recognise phishing, and are emails filtered for phishing and malicious attachments?
Yes means staff learn to spot phishing, for example with simulated phishing emails, and incoming email is filtered for spam, phishing and malware.
NIS2 21(2)(g) · ISO 27001 A.6.3, A.8.7
22.Are all your laptops, desktops and servers centrally managed, securely configured and protected by up-to-date malware protection?
Yes means devices follow a secure baseline configuration, settings and updates are enforced centrally and malware protection is active and current on all of them.
NIS2 21(2)(g) · ISO 27001 A.8.1, A.8.7, A.8.9
23.Is our data encrypted whenever it is sent over public networks, for example with current TLS versions?
Yes means all connections carrying our data, including web, APIs, file transfer and email transport, use current encryption and outdated protocols are disabled.
NIS2 21(2)(h) · ISO 27001 A.8.24, A.5.14
24.Is our data encrypted where it is stored, including on laptops, mobile devices and backups, with the keys protected?
Yes means storage holding our data is encrypted with current methods, and encryption keys are managed and kept separate from the data they protect.
NIS2 21(2)(h) · ISO 27001 A.8.24
25.Do people get only the access they need, with admin rights limited and access rights reviewed at least once a year?
Yes means access is approved by need-to-know, everyone has a personal account, admin rights are few and separate, and rights are reviewed yearly.
NIS2 21(2)(i) · ISO 27001 A.5.15, A.5.18, A.8.2
26.Do you remove all access of leavers on their last working day and collect their devices?
Yes means accounts, remote and cloud access of people who leave or change roles are removed on time, and laptops, phones and access cards are returned.
NIS2 21(2)(i) · ISO 27001 A.5.18, A.6.5, A.5.11
27.Are employees and contractors with access to our data screened as appropriate and bound by confidentiality obligations?
Yes means background checks fit the role and applicable law, and contracts or signed agreements oblige staff and contractors to keep information confidential.
NIS2 21(2)(i) · ISO 27001 A.6.1, A.6.2, A.6.6
28.Do you keep a current inventory of the hardware, software, cloud services and data used for the services you provide to us?
Yes means an up-to-date inventory lists these assets with an owner and their criticality, and it is updated when things change.
NIS2 21(2)(i) · ISO 27001 A.5.9, A.5.12
29.Is multi-factor authentication required for email, remote access and cloud services?
Yes means every user must use a second factor, such as an app or security key, for these services, with no exceptions for regular accounts.
NIS2 21(2)(j) · ISO 27001 A.8.5
30.Do all administrator accounts and all access to systems that hold our data use multi-factor authentication?
Yes means admin accounts and any access to systems processing our data, including by your own suppliers, always require a second factor.
NIS2 21(2)(j) · ISO 27001 A.8.5, A.8.2
31.Do you use secured voice, video and text communication, and a secured channel for emergencies when normal systems fail?
Yes means business communication uses encrypted tools approved by you, and an alternative secured way to reach staff and customers exists for emergencies.
NIS2 21(2)(j) · ISO 27001 A.5.14, A.8.20
| No. | Question | What a yes means | NIS2 | ISO 27001 | Answer (Yes / Partly / No / Not applicable) | Evidence or comment |
|---|---|---|---|---|---|---|
| 1 | Do you have a written information security policy that is approved by your management? | Yes means a current security policy exists, is approved by management, is reviewed regularly and is known to your staff. | 21(2)(a) | A.5.1 | ||
| 2 | Have you named a person who is responsible for information security in your organization? | Yes means a named person, internal or external, is responsible for security, has management support and can be contacted by customers. | 21(2)(a) | A.5.2, A.5.4 | ||
| 3 | Do you identify and assess information security risks at least once a year and track how they are treated? | Yes means you follow a defined risk method, keep a risk register with owners and treatment, and update it at least yearly and after major changes. | 21(2)(a) | A.5.1, A.5.7 | ||
| 4 | Do you have a written incident response plan with roles, steps and contacts? | Yes means a current plan describes who does what when a security incident occurs, including escalation, containment, recovery and contact details. | 21(2)(b) | A.5.24, A.5.26 | ||
| 5 | Will you notify us within 24 hours of becoming aware of a security incident that affects our data or the services you provide to us? | Yes means you have a named contact and a process to warn us within 24 hours and to keep us informed until the incident is closed. | 21(2)(b) | A.5.24, A.5.26 | ||
| 6 | Do you log security-relevant events and monitor them to detect suspicious activity? | Yes means sign-ins, admin actions and security alerts are logged, logs are protected and kept for a set time, and someone reviews alerts promptly. | 21(2)(b) | A.8.15, A.8.16 | ||
| 7 | Do you record every security incident and use the lessons learned to improve your security? | Yes means each incident is documented with cause, impact and actions taken, and follow-up improvements are tracked until they are done. | 21(2)(b) | A.5.25, A.5.27 | ||
| 8 | Do you back up important data and systems regularly, with at least one copy kept offline or otherwise protected from ransomware? | Yes means backups run on a written schedule, cover cloud data too, and at least one copy cannot be changed or deleted from your normal network. | 21(2)(c) | A.8.13 | ||
| 9 | Do you test restoring data and systems from backups at least once a year? | Yes means restores are actually performed and timed at least yearly, and the results and any problems are recorded. | 21(2)(c) | A.8.13 | ||
| 10 | Do you have a tested plan for continuing or restoring the services you provide to us after a major disruption or crisis? | Yes means a continuity and crisis plan sets recovery times and responsibilities for these services and has been tested, for example in an exercise, within the last year. | 21(2)(c) | A.5.29, A.5.30 | ||
| 11 | Do you set security requirements for your own suppliers and include them in your contracts with them? | Yes means contracts with suppliers that handle data or services relevant to us include security, confidentiality and incident notification duties. | 21(2)(d) | A.5.19, A.5.20 | ||
| 12 | Will you tell us which subcontractors support the services you provide to us and inform us before you change them? | Yes means you can provide a current list of subcontractors involved in our services or data, including their location, and announce changes in advance. | 21(2)(d) | A.5.21, A.5.19 | ||
| 13 | Do you assess the security of your critical suppliers before contracting and regularly afterwards? | Yes means critical suppliers are checked, for example by questionnaire, certificate or audit, before contracting and at least every one to two years. | 21(2)(d) | A.5.22 | ||
| 14 | Do you install security updates within set times, with critical updates applied within days? | Yes means operating systems, applications and devices are patched on a defined schedule, critical fixes are prioritised and unsupported software is replaced. | 21(2)(e) | A.8.8, A.8.19 | ||
| 15 | Do you scan your systems for vulnerabilities regularly and fix findings within set times based on severity? | Yes means systems, especially internet-facing ones, are scanned regularly and findings are fixed within deadlines that depend on their severity. | 21(2)(e) | A.8.8 | ||
| 16 | If you develop or maintain software for us, do you follow secure development practices, including code review and security testing before release? | Yes means secure coding rules apply, changes are reviewed by another person and security tests run before release. Choose Not applicable if you do not develop software for us. | 21(2)(e) | A.8.25, A.8.28, A.8.29 | ||
| 17 | Do you have a process for receiving vulnerability reports and informing customers about vulnerabilities that affect them? | Yes means anyone can report a vulnerability to a published contact, reports are handled by a defined process and affected customers are told about risks and fixes. | 21(2)(e) | A.8.8, A.5.24 | ||
| 18 | Do you regularly check whether your security measures work, for example through internal audits or security indicators? | Yes means you check your measures by a plan, report results to management and track corrective actions until they are done. | 21(2)(f) | A.5.35, A.5.36 | ||
| 19 | Has your security been reviewed independently in the last three years, for example by an external audit, certification or penetration test? | Yes means an independent party reviewed your security or the systems used for our services, and you can share a summary, certificate or report on request. | 21(2)(f) | A.5.35, A.8.8 | ||
| 20 | Do all your employees receive security awareness training when they join and at least once a year? | Yes means everyone, including management, is trained on security basics at onboarding and yearly, and you keep records of who completed it. | 21(2)(g) | A.6.3 | ||
| 21 | Are your employees trained to recognise phishing, and are emails filtered for phishing and malicious attachments? | Yes means staff learn to spot phishing, for example with simulated phishing emails, and incoming email is filtered for spam, phishing and malware. | 21(2)(g) | A.6.3, A.8.7 | ||
| 22 | Are all your laptops, desktops and servers centrally managed, securely configured and protected by up-to-date malware protection? | Yes means devices follow a secure baseline configuration, settings and updates are enforced centrally and malware protection is active and current on all of them. | 21(2)(g) | A.8.1, A.8.7, A.8.9 | ||
| 23 | Is our data encrypted whenever it is sent over public networks, for example with current TLS versions? | Yes means all connections carrying our data, including web, APIs, file transfer and email transport, use current encryption and outdated protocols are disabled. | 21(2)(h) | A.8.24, A.5.14 | ||
| 24 | Is our data encrypted where it is stored, including on laptops, mobile devices and backups, with the keys protected? | Yes means storage holding our data is encrypted with current methods, and encryption keys are managed and kept separate from the data they protect. | 21(2)(h) | A.8.24 | ||
| 25 | Do people get only the access they need, with admin rights limited and access rights reviewed at least once a year? | Yes means access is approved by need-to-know, everyone has a personal account, admin rights are few and separate, and rights are reviewed yearly. | 21(2)(i) | A.5.15, A.5.18, A.8.2 | ||
| 26 | Do you remove all access of leavers on their last working day and collect their devices? | Yes means accounts, remote and cloud access of people who leave or change roles are removed on time, and laptops, phones and access cards are returned. | 21(2)(i) | A.5.18, A.6.5, A.5.11 | ||
| 27 | Are employees and contractors with access to our data screened as appropriate and bound by confidentiality obligations? | Yes means background checks fit the role and applicable law, and contracts or signed agreements oblige staff and contractors to keep information confidential. | 21(2)(i) | A.6.1, A.6.2, A.6.6 | ||
| 28 | Do you keep a current inventory of the hardware, software, cloud services and data used for the services you provide to us? | Yes means an up-to-date inventory lists these assets with an owner and their criticality, and it is updated when things change. | 21(2)(i) | A.5.9, A.5.12 | ||
| 29 | Is multi-factor authentication required for email, remote access and cloud services? | Yes means every user must use a second factor, such as an app or security key, for these services, with no exceptions for regular accounts. | 21(2)(j) | A.8.5 | ||
| 30 | Do all administrator accounts and all access to systems that hold our data use multi-factor authentication? | Yes means admin accounts and any access to systems processing our data, including by your own suppliers, always require a second factor. | 21(2)(j) | A.8.5, A.8.2 | ||
| 31 | Do you use secured voice, video and text communication, and a secured channel for emergencies when normal systems fail? | Yes means business communication uses encrypted tools approved by you, and an alternative secured way to reach staff and customers exists for emergencies. | 21(2)(j) | A.5.14, A.8.20 |
ISO 27001 is named by control codes only. The questions are the same as the built-in supplier checks of CloudSignLab.
Do it in CloudSignLab
Send the questions online: suppliers answer without an account and you see their score against your minimum.
Get new templates and NIS2 news
Optional: we email you when we publish a new template or guide. You confirm by email first and can unsubscribe at any time.