A customer sent you a security questionnaire
Customers under NIS2, DORA and the GDPR have to check the suppliers they rely on, so the questions reach businesses those laws do not cover. Where each question comes from, and how to answer it once, with proof.
Why you are being asked
NIS2 makes supply chain security one of the measures a regulated organisation must take (Article 21(2)(d)), and asks it to weigh each direct supplier's security practices (Article 21(3)). DORA sets the terms a bank, insurer or payment firm must put in its contracts with technology providers (Article 30). The GDPR sets what a business must agree with anyone who processes personal data for it (Article 28).
The law binds your customer. The contract binds you, from the day you sign it, even before Ireland transposes NIS2. It has not yet: on 8 July 2026 the European Commission decided to refer Ireland to the Court of Justice over it. The NIS2 supplier guide has the detail and the sources.
What the questions cover
The supplier questionnaire check goes through them one by one: which answers you can prove today, the proof each needs, and the fix.
- Access: two-step sign-in for your staff, your email, remote access and admin accounts, and how access is removed when somebody leaves.
- Backups: how they are made, whether they are kept apart from the main network, and when a restore was last tested.
- Incidents: whether you will tell the customer of one that affects them, how soon, and through whom.
- Personal data: what you process for them, where, and with which sub-processors.
- Certification: whether you hold ISO 27001, or have a SOC 2 report.
SOC 2 or ISO 27001
The one to get is the one your customer asks for. SOC 2 is a report on your controls written by a licensed, independent CPA under the AICPA's standards. ISO 27001 ends in a certificate from a certification body, which in Ireland is accredited by INAB. Neither is needed to answer a questionnaire truthfully; both take longer than one. See SOC 2 or ISO 27001 and our ISO 27001 readiness work.
What we do
Protect, from €3,450 up to 10 staff
We put in place the basics most questionnaires ask about: two-step sign-in, backups with a tested restore, email protection, an incident plan and a record of the personal data you hold. Each comes with dated evidence, so every yes on the questionnaire is true and you can attach the proof.
Read first
- Free toolSupplier security questionnaire checkWhich answers you can prove, where each question comes from, and the fix.
- NIS2 for suppliers: the questions your customer will askThe questions, grouped, with the article or guidance each one comes from.
- SOC 2 vs ISO 27001A CPA's report or an accredited certificate, and how to tell which one is wanted.
- What ISO 27001 costs in IrelandCertification fees and the work before them.
- Data processing agreement checklistWhat GDPR Article 28 asks you to sign when you handle a customer's personal data.
- NIS2 in IrelandWhere the law stands, and what applies in the meantime.
Start here
The free compliance check looks at your website and email from outside while you answer a few questions, and keeps the result as your compliance record. Or tell us what you have been asked, and we tell you what to do first.