Your customer asks for NIS2 or ISO 27001 evidence
The question does not come from a supervisor but from a customer: a security questionnaire, a request for your certificate or a new clause in the contract. Here you read why customers ask, what they usually want to see and how to get the evidence in order.
Updated
Your customer has to manage the security of its suppliers
Under the duty of care in article 21, third paragraph, under d, of the Cyberbeveiligingswet, every essential and important entity has to manage the security of its suppliers. Direct suppliers and service providers fall within that duty of care: the customer weighs each supplier’s vulnerabilities, the quality of its products and its secure development practices.
So the legal duty lies with your customer. To meet it, the customer asks you to show how you secure your side. Whether you fall under the Act yourself depends on your own sector and size; that is separate from your customer’s question.
An accredited ISO 27001 certificate is the evidence customers accept most readily. It is not the only route: without a certificate you can still answer with a well-substantiated evidence file.
What customers usually want to see
These are the forms to expect, often in combination.
- A security questionnaire
- Questions on policy, access control, backups, incident handling and your own suppliers. Strong answers point to evidence you can produce, not to intentions.
- An ISO 27001 certificate
- Issued by an accredited certification body, with its scope. The customer checks whether the service you provide falls within that scope.
- Evidence of measures
- Documents that show measures exist and work: a risk assessment, an incident procedure, test results or an audit report.
- Contract clauses
- Agreements on security requirements, on reporting incidents to the customer and on the customer’s right to check.
From question to demonstrable answer
- A baseline assessment and gap analysis: what is already in place, what can be demonstrated and where it falls short of what your customer or the law asks.
- A written audit report with findings, a prioritisation and a substantiated scope. The report is yours.
- Implementation of ISO 27001 or of the NIS2 duty of care, with audit-ready documentation.
- An internal audit by a team that did not set up the system itself.
- Preparation for Stage 1 and Stage 2 of the certification audit. The certificate itself is issued by an accredited certification body, not by us.
- An evidence file that stays current, so you answer the next questionnaire with the same evidence.
What clients ask us
Know what you can demonstrate
Fill in the form. Within 24 hours you receive a written first analysis. There is no charge, and a conversation follows only if you ask for one.