NIS2 Supplier Questionnaire: ISO 27001 or SOC 2?
A European enterprise customer has just sent you a 120-question NIS2 supplier questionnaire, and procurement wants answers within two weeks. You already hold ISO 27001 or a SOC 2 report, so you are covered, right? Not qu
A European enterprise customer has just sent you a 120-question NIS2 supplier questionnaire, and procurement wants answers within two weeks. You already hold ISO 27001 or a SOC 2 report, so you are covered, right? Not quite. The gap between βcertifiedβ and βNIS2-readyβ is exactly where EU deals quietly stall.
Here is what your customers really ask, what ISO 27001 and SOC 2 prove, and how to close the gaps before the next questionnaire lands.
Why EU Customers Are Sending NIS2 Supplier Questionnaires
The NIS2 Directive (Directive (EU) 2022/2555) requires essential and important entities to manage cyber risk. NIS2 supply chain security is one of its ten minimum measures under Article 21(2)(d), and Article 21(3) tells customers to weigh each direct supplierβs specific vulnerabilities, product quality and cybersecurity practices.
The pressure is real. As of October 2026, national NIS2 laws are in force in 24 of 27 EU member states, with France, Ireland and Spain still outstanding after the Commission referred four states to the Court of Justice in July. The Netherlandsβ law took effect on 15 August 2026 and Austriaβs on 1 October 2026. Fines reach β¬10 million or 2% of worldwide turnover for essential entities (β¬7 million or 1.4% for important ones), and Article 20 makes management bodies accountable. Your customerβs risk becomes your sales cycle, even if your own country has no live law.
What a NIS2 Supplier Questionnaire Really Asks
Expect questions mapped to the Article 21(2) measures. Typical themes:
- Governance and risk analysis: policies, risk assessments, management sign-off.
- Incident handling: detection, escalation and how fast you will notify the customer.
- Business continuity: backups, disaster recovery and tested restores.
- Supplier management: your own subprocessors and fourth parties.
- Secure development and vulnerabilities: patching, disclosure, penetration testing.
- Access control and encryption: who touches customer data, and how it is protected.
Does ISO 27001 Satisfy a NIS2 Supplier Questionnaire?
Largely, as strong evidence rather than complete proof. An ISO 27001:2022 certificate shows an independently audited information security management system covering risk, incident response, continuity and supplier controls (Annex A 5.19β5.23). Procurement teams like it because they can verify it with the certification body.
Before attaching it, check four things: the scope covers the exact service you sell; the certificate is to the 2022 edition (the transition from ISO 27001:2013 ended on 31 October 2025); the issuing body is accredited; and you can share your Statement of Applicability. Still building towards it? VISTA InfoSecβs ISO 27001 audit and certification service is a practical starting point.
Does SOC 2 Satisfy a NIS2 Supplier Questionnaire?
SOC 2 is an attestation report issued by a CPA firm against the AICPA Trust Services Criteria, not a certification. A Type II report tests whether controls operated effectively over a review period, and it addresses vendor management under CC9. Our guide to SOC 2 Type 1 vs Type 2 explains the difference.
The blind spots for EU buyers: reports are usually treated as current for about 12 months, so older ones need a bridge letter; exceptions and carve-outs for subservice organisations matter; and only the Security criterion is mandatory, so confirm what is in scope. Need a report? See SOC 2 compliance and attestation.
| Aspect | ISO 27001:2022 | SOC 2 |
|---|---|---|
| Nature | Certification of an ISMS | Attestation report on controls |
| Issued by | Accredited certification body | Licensed CPA firm |
| Validity | Three-year cycle, annual surveillance audits | Review period, typically about 12 months |
| Strength | Management system recognised across the EU | Detailed control testing (Type II) |
| Typical gap | Scope and edition | Exceptions and carve-outs |
Where ISO 27001 and SOC 2 Both Fall Short
NIS2 itself does not name either framework as mandatory proof, and there is no βNIS2 certificateβ. Customers still need answers neither document gives:
- Incident notification to customers. Under Article 23 your customer must send an early warning within 24 hours and a notification within 72 hours, so they will expect you to tell them much sooner.
- Data location and subprocessors. EU buyers ask where data sits and who can access it, tied to GDPR processor terms.
- Contract clauses. Audit rights, security requirements and exit terms.
- Vulnerability evidence. Recent penetration testing results.
- Sector rules. Cloud, data-centre and managed-service providers face detailed technical requirements under Implementing Regulation (EU) 2024/2690, and financial clients may add DORA demands.
How to Answer a NIS2 Supplier Questionnaire and Win the Deal
1. Map first. Link each Article 21(2) measure to a control you already run.
2. Lead with evidence. Attach your certificate and Statement of Applicability or SOC 2 report, plus a penetration-test summary.
3. Be precise about scope. State which services, sites and periods the assurance covers.
4. Commit to a notification window. Put a fast, written incident-notification commitment in the contract.
5. Build an answer library. Reuse approved responses for every future questionnaire.
National rules differ, so tailor answers by market. VISTA InfoSecβs NIS2 compliance consulting for Germany and NIS2 compliance in the Netherlands cover local specifics, while the broader NIS2 compliance and audit service supports gap assessments.
Frequently Asked Questions
Is ISO 27001 enough for a NIS2 supplier questionnaire?
It is strong evidence, not a guarantee. NIS2 expects a risk-based view of each supplier, so customers may still ask about scope, incident-notification commitments and contract terms.
Do non-EU suppliers need to worry about NIS2?
Not automatically, although some non-EU digital providers serving the EU are in scope themselves. Either way, EU customers pass requirements down through contracts.
Should I get ISO 27001 or SOC 2 first?
Start with whichever your buyers request most. ISO 27001 is widely recognised across Europe, SOC 2 is common with US-linked buyers, and many suppliers eventually hold both.
The Bottom Line
ISO 27001 and SOC 2 open the door, but neither answers a NIS2 supplier questionnaire alone. Pair your assurance with a clear scope, fast incident notification and EU-ready data answers, and a compliance hurdle becomes a trust signal. Ready to see where you stand? Book a free consultation with VISTA InfoSec.
Sources: Directive (EU) 2022/2555 (NIS2), EUR-Lex | European Commission: NIS transposition status
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.