Many SMEs know the situation: an important customer sends a questionnaire with a hundred or more questions on information security, due in two weeks. The reason usually lies not with the supplier but with the customer. Since NIS2 came into force in Germany in December 2025 and in Austria in October 2026, and DORA has applied in the financial sector since January 2025, many companies must demonstrate the security of their supply chain.
Why the questionnaires arrive
NIS2 requires covered entities to include supply chain security in their risk management. DORA obliges financial entities to assess ICT providers, record them in a register and bind them with minimum clauses. Both reach suppliers as questionnaires, contract annexes or audits. For Swiss suppliers NIS2 does not apply as law, but it does through these contracts.
The topics repeat
Questionnaires differ in format, hardly in content. Almost always asked about: responsibility for information security, policies, access control and multi-factor authentication, encryption, backups and their testing, vulnerability management and updates, logging, incident and reporting processes, staff training, sub-processors, data protection and storage locations, certifications. Answering these twelve topics properly covers most of any questionnaire.
Honesty pays off
The temptation to answer positively so as not to risk the contract is strong. That is dangerous: many customers write the answers into the contract as warranties. In an incident, an embellished answer becomes a liability problem. Better is an honest answer with a plan: this measure is planned, implemented by then, owned by this person. Experienced buyers value this more than flawless answers they do not believe.
An answer library instead of one-off work
The most important lever is to work out answers only once. A library of standard answers to the recurring topics, linked to evidence such as policies, configuration extracts and test records, turns days into hours. What matters is that one person maintains it and that it matches practice.
When certification helps
ISO 27001 certification answers many questions at once and is explicitly required by some customers. It is not a must, though. Companies receiving questionnaires regularly should check how often a certificate is requested. Beyond a certain frequency, certification saves more time than the audits cost.
How to start
- Appoint a responsible person.
- Bring existing documents up to date.
- Answer the twelve core topics once and link evidence.
- Record gaps honestly and prioritise them by how often questionnaires ask about them.
- Use every new questionnaire to extend the library.
Our supplier questionnaire checklist walks through these steps. When a questionnaire is due, our answering security questionnaires offer helps; for a solid foundation there is building an ISMS to ISO 27001.