Supplier Audit Questionnaire: 40 Questions for NIS2

Main article: Securing the NIS2 supply chain — the full article on this topic.

DE/AT note: The supervisory authority is the Federal Office for Information Security (BSI) in Germany and the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) in Austria. The German Supply Chain Due Diligence Act (LkSG) applies only in Germany — Austria has no equivalent. The 40 questions in this questionnaire are geared to supply chain security under NIS2 and to processing on behalf of a controller under Art. 28 GDPR; they do not replace an LkSG review.

Legal basis: which obligation these 40 questions serve

The questionnaire serves a statutory mandatory area, not a voluntary extra: in Germany, supply chain security under § 30(2) no. 4 BSIG is one of the measure areas that every entity in scope must cover; in Austria, the parallel obligation is set out in § 32(4)(d) NISG 2026 (Federal Law Gazette I No. 94/2025) and takes effect when the act becomes applicable on 1 October 2026.

The obligation does not, however, apply to every company. In Germany, a particularly important entity is one that can be allocated to an entity type under Annex 1 BSIG and employs at least 250 people, or has an annual turnover of more than EUR 50 million together with an annual balance sheet total of more than EUR 43 million; an important entity is one that can be allocated to a type under Annex 1 or 2 and employs at least 50 people, or has an annual turnover and an annual balance sheet total of more than EUR 10 million each (§ 28(1) and (2) BSIG). Covered regardless of size are, among others, operators of critical installations, qualified trust service providers, TLD name registries and DNS service providers. Austria follows the same structure: § 24 NISG 2026 distinguishes essential entities and important entities, and the size classes are set out in § 25(2) and (3) NISG 2026.

The Austrian NISG 2026 provisions apply from the start of application on 1 October 2026; Art. 28 GDPR already applies in both countries today. Whether the supplier itself falls under NIS2 is independent of this and must be assessed separately.

Before you send it out: prioritise suppliers and set the rhythm

Auditing is risk-based, not blanket coverage — before the first mailing you need a tier classification and a follow-up rhythm. Tier 1 is a supplier that is critical for business continuity or has access to personal data; tier 2 covers suppliers of medium importance, tier 3 the rest. In an SME with 50 to 250 employees, based on our experience, 8 to 15 suppliers fall into tier 1 and 20 to 40 into tier 2 — the common "top 20" rule of thumb refers to this tier 1 group. Experience shows an effort of 12 person-days initially and 3 person-days per year.

For the rhythm, a practical recommendation applies, not a statutory deadline: tier 1 annually plus after incidents or contract changes, tier 2 in full every two years with an annual update self-disclosure, tier 3 every three to five years. In Germany, a recurring statutory evidence deadline primarily affects operators of critical installations: they demonstrate the implementation of their measures at a point in time set by the BSI — at the earliest three years after they first qualify as such — and every three years thereafter, by means of security audits, reviews or certifications (§ 39(1) BSIG). That deadline concerns your own relationship with the supervisory authority, not the cycle of your supplier reviews.

Section A: General security (8 questions)

Section A clarifies whether the supplier manages security systematically rather than case by case. The benchmark for your assessment follows from your own obligation: under § 30(2) sentence 1 BSIG, the measures should comply with the state of the art, take account of the relevant European and international standards, and must be based on an all-hazards approach.

An ISO 27001 certificate shows that the supplier applies a relevant international standard within the meaning of § 30(2) sentence 1 BSIG, but it is not full evidence: it covers the requirements of Section 30 BSIG structurally in all ten areas, but congruently in none; the typical gaps lie in the NIS2 reporting obligations (§ 32 BSIG), supply chain due diligence (§ 30(2) no. 4 BSIG) and the obligations of the management bodies (Section 38 BSIG). Useful reference points for the state of the art are the BSI IT-Grundschutz modules, ISO 27002, the ENISA Technical Implementation Guidance v1.0 (26 June 2025) and sector-specific standards such as TISAX in the automotive environment. For all eight questions the same applies: what goes into the file is the document with date, scope and exceptions, not the tick in the questionnaire — the evidence column names, for each question, which document that is.

Section B: Data protection + GDPR (6 questions)

Section B examines processing on behalf of a controller. You need these six questions because Art. 28(1) GDPR prohibits you from working with data processors that do not provide sufficient guarantees of appropriate technical and organisational measures. Under Art. 28(3) GDPR, the contract must set out at least the subject matter and duration, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller.

On question 10: the appointment obligation follows from Art. 37(1) GDPR. In Germany, § 38(1) of the German Federal Data Protection Act (BDSG) is added — a data protection officer must be appointed as soon as, as a rule, at least 20 people are constantly engaged in the automated processing of personal data, and, irrespective of the number of people, also for processing operations subject to a data protection impact assessment under Art. 35 GDPR. Austria does not provide for any numerical threshold going beyond Art. 37 GDPR (§ 5 of the Austrian Data Protection Act (DSG)). A "no" to question 10 therefore only becomes a finding after these criteria have been assessed. On question 11: the 24-hour assurance is not a GDPR deadline — the GDPR requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33(1)). The 24 hours are the contractual input to your own deadlines, see Section C.

Questions 12 to 14 are the legally most demanding part of the section. Question 12 only becomes verifiable once you ask, instead of for the product name, for the regions in which data are stored and processed — including support and remote maintenance access. Question 13 targets the second level, which Section D takes further; your benchmark remains the guarantee requirement of Art. 28(1) GDPR towards your data processor, which is why you need to know whom it engages. As a practical recommendation for question 14, require the specific transfer mechanism for each third country service provider instead of a blanket assurance — that is, which mechanism supports which service provider: standard contractual clauses (SCC), the EU-US Data Privacy Framework (DPF) or another mechanism identified by name.

Section C: Incident management (5 questions)

Section C determines whether you can meet your own reporting deadlines. In Germany, particularly important entities and important entities report a significant security incident to the joint reporting office of the BSI and the BBK without undue delay, at the latest within 24 hours of becoming aware of it as an early initial notification, within 72 hours with an initial assessment, and at the latest one month after the 72-hour notification as a final report; on request, an interim report is added (§ 32(1) no. 1 to 4 BSIG). If the incident is ongoing, a progress report initially takes the place of the final report (§ 32(2) BSIG). In Austria, the same three-stage scheme applies towards the competent CSIRT from the start of application on 1 October 2026 (§ 34(2) no. 1 to 5 NISG 2026).

For question 15, ask about the statutory threshold rather than about "incidents" in general: an incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss, or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG, in Austria § 35(1) NISG 2026). The figure alone is not yet a finding: the practical threshold is more than one serious incident in the last 24 months that was not followed by a structural measure. Question 16 is only usable with a reference basis and should be held against your own 24-hour early warning under § 32(1) no. 1 BSIG — if the median is above that, the contractual assurance from this section does not hold.

Incident notification by the supplier to you is — like cybersecurity clauses and right-to-audit — among the contractual contents through which the mandatory area of supply chain security (§ 30(2) no. 4 BSIG) can be implemented; the specific drafting as a contract clause with a 24-hour deadline is a practical recommendation. For questions 17 to 19 this means: a notification commitment of 24 hours from the supplier becoming aware. Your own statutory deadline under § 32(1) no. 1 BSIG runs from awareness, not from the start of the incident, and does not stop for weekends — which is why the supplier's input should work around the clock; this is an organisational consequence of the deadline. What the contract clause should set out in detail is covered in the frequently asked questions.

Section D: Sub-suppliers (5 questions)

Section D extends the review to the second level, which otherwise remains invisible: subcontractors of your supplier touch your data and systems without being your contractual partner. In security law terms this falls under the mandatory area of supply chain security (§ 30(2) no. 4 BSIG, in Austria § 32(4)(d) NISG 2026); in data protection terms the benchmark remains the guarantee requirement of Art. 28(1) GDPR towards your data processor (Section B) — which is why you need to know whom it engages. Question 20 is accordingly broader than question 13: it covers every sub-supplier with access to your systems or premises, even without a personal data element, whereas question 13 only asks about the sub-processors within the meaning of Art. 28 GDPR.

Practical recommendation for critical suppliers: cybersecurity clauses and a right-to-audit belong in the standard contract; both implement the mandatory area of supply chain security (§ 30(2) no. 4 BSIG) contractually, and missing cybersecurity clauses in contracts are, in our practical assessment, a typical audit finding in this area. Practical recommendation on question 23: agree the approval workflow so that new sub-suppliers are notified before deployment and you have a review period. Practical recommendation on questions 20 and 24: keep the sub-supplier list with a date and version and reconcile it against the contractual status at least once a year — a list without a status date is no evidence in a conversation with the supervisory authority.

Section E: Personnel security (5 questions)

Section E examines the personnel side, which § 30(2) no. 9 BSIG treats as a mandatory area of its own: personnel security and access control. What is expected is an authorisation concept based on the need-to-know principle, its regular review, structured onboarding and offboarding procedures and, where the risk warrants it, security screening of staff.

Question 28 targets a different mandatory area: basic training and awareness measures under § 30(2) no. 7 BSIG, in Austria § 32(4)(g) NISG 2026. The common term "cyber hygiene" does not come from the BSIG but from Art. 21(2)(g) of Directive (EU) 2022/2555. As a practical rhythm — expressly not a statutory deadline — annual training with a knowledge check, quarterly phishing simulations with an evaluation of the click rate and onboarding training within the first four weeks have become established.

Section F: Technical measures (6 questions)

Section F asks about the basic technical measures that § 30(2) BSIG lists under separate numbers: cryptography and encryption (no. 8), multi-factor authentication, continuous authentication and secured communications (no. 10), as well as security in acquisition, development and maintenance including vulnerability management (no. 5). Austria covers the same content in the catalogue of § 32(4)(a) to (j) NISG 2026.

The state-of-the-art guidance for questions 30 to 33 is set out in the evidence column. Encryption has a second, often overlooked effect: under Art. 34(3) GDPR, communication to data subjects may be dispensed with if appropriate technical and organisational protection measures — in particular encryption — have been applied. For question 31, the practical benchmark is: MFA for all admin accounts and all external access routes; purely office use by employees can be justified on a risk basis. On question 35, the practical recommendation is: without details of log sources, retention period and alerting, the notification commitment from Section C does not hold, because a supplier can only report what it notices.

Section G: Recovery + backup (3 questions)

Section G covers the mandatory area of "business continuity" — backup management, disaster recovery and crisis management (§ 30(2) no. 3 BSIG, in Austria § 32(4)(c) NISG 2026). These three questions determine whether an outage at the supplier becomes a disruption or a business interruption for you.

Question 38 is the section's real test question: a restore test with a logged result distinguishes a practised procedure from a declaration of intent, and only the measured recovery time can be held against the RTO of your own business process that builds on the supplier. If it is above that, the supplier's commitment does not support your process.

Section H: Compliance + audit (2 questions)

Section H secures the evidence — your own, not the supplier's. § 30(1) BSIG requires that compliance with the risk management measures be documented; the management bodies must implement the measures under § 38(1) BSIG and monitor their implementation, and are liable to their entity under § 38(2) BSIG for culpably caused damage in accordance with the rules of the company law applicable to the legal form. In Austria, the management bodies must ensure and supervise compliance with the risk management measures (§ 31(1) NISG 2026); the NISG 2026 contains no express internal liability rule modelled on § 38(2) BSIG.

From finding to decision — practical recommendation for the evaluation: a single finding is a measure with an owner and a deadline, not an exclusion. What is exclusion-relevant are the seven serious findings that the frequently asked questions list individually. If one of them applies, tier 1 status is not defensible; what remains is an alternative supplier, compensation through your own technical protection measures, or a documented risk acceptance signed off by the management bodies, which have to monitor the implementation of the risk management measures in any event (§ 38(1) BSIG).

The audit trail is thus part of compliance and not an accessory. Practical recommendation for the file kept on each supplier: the completed questionnaire with the date and the person answering, your assessment, the measure derived from it with an owner, the follow-up date — and retention of the audit results for six years (practical recommendation, not a statutory retention period). In Austria, a separate declaration stage is added: essential entities and important entities submit structured information on the risk management measures implemented to the Cybersecurity Authority within twelve months of the registration obligation arising (§ 33(1) NISG 2026); the authority may require evidence from an independent body at the earliest two years after entry into force (§ 33(2) NISG 2026).