It usually turns up with a contract renewal, or tucked into the purchasing terms of a customer much bigger than you. "Do you use multi-factor authentication? Do you test your backups? Who do we call if there's an incident?" Sometimes there's a clause as well, asking you to comply with "NIS2 requirements". You employ twelve people and your business sits in none of the sectors the law covers. So what do you write?
This is how I handle it. I'm not a lawyer, so have your own adviser read the clause itself. The rules quoted below come from the Belgian law, its royal decree and the Centre for Cybersecurity Belgium (CCB) website.
Why this landed on your desk
The Belgian NIS2 Act of 26 April 2024 came into force on 18 October 2024. As a rule, it covers organisations established in Belgium that provide a service listed in its annexes (energy, transport, health, digital infrastructure and manufacturing, among others) and are at least medium-sized: 50 full-time equivalents, or more than 10 million euros in both annual turnover and balance sheet total. A handful of entity types are covered whatever their size, such as DNS service providers and public electronic communications providers. Outside those cases, and unless the CCB designates it, a small business has no duty to register with the CCB or to report its incidents to it.
Your customer, on the other hand, is in scope. Article 30 of the Act requires it to manage cyber risks, and one of the listed measures is supply chain security, including the security side of its relationship with each direct supplier and service provider. It has to weigh each direct supplier's own weak spots, but the law doesn't say how. The questionnaire is how your customer does it, and it leaves a paper trail it can show an inspector.
For essential entities, the royal decree of 9 June 2024 sets out a two-step conformity assessment: a first milestone by 18 April 2026 and the next by 18 April 2027. In the higher CyFun levels, keeping track of suppliers and setting their obligations in contracts is one of the controls.
What your customer actually needs to know
Behind the long list there are really three questions. Could you be the way into an incident on their side? Would they hear about it quickly? Would you recover? An entity under NIS2 has to send the national CSIRT an early warning within 24 hours of becoming aware of a significant incident, then an incident notification within 72 hours. If a hijacked mailbox of yours starts sending booby-trapped invoices to their accounts team, they need to hear it from you, and early.
The yardstick: CyFun Basic
The CCB advises any organisation that may sit in the supply chain of a NIS2 entity to meet at least the Basic level of the CyberFundamentals framework (CyFun). It's free, and it comes with a self-assessment spreadsheet. There's also an entry level called Small, meant for micro-organisations or teams with little technical background. The 2023 and 2025 versions can both be used until 18 April 2027.
The Basic key measures match what these questionnaires ask almost line for line:
- multi-factor authentication wherever possible, and always for remote access;
- backups of business-critical data, stored on a different system from the one holding the originals;
- security patches installed on operating systems and critical components;
- access rights kept to what each person needs, and nobody working day to day with admin rights;
- a firewall that is switched on and maintained, and logs that are kept.
The questions that keep coming up
I answer one question at a time, with three things each time: what's in place, since when, and what isn't done yet. The topics that almost always appear:
- MFA: which accounts have it (email, admin accounts, remote access), which don't yet, and when they will;
- backups: where they're stored, how often they run, and the date of the last restore test. "Yes, we back up" tells them nothing;
- updates: automatic on laptops and desktops or not, and who looks after the firewall, the NAS or the server. If that's your IT provider, say so;
- incident contact: a named person with an email address and a phone number that get answered, a deputy, and a notice period you can genuinely keep;
- access by your own subcontractors: who at your providers can get into your systems or the customer's, with which account, and how that access is removed when the job ends.
A dated register, with names
Before filling anything in, I get the business to start a register. A spreadsheet is enough: the measure, where it applies, who owns it, when it was put in place, when it was last checked, and the evidence (a screenshot, a report, an invoice). That's what makes your answers checkable, and you'll reuse it for the next questionnaire.
It protects you as well. When an answer stops being true, because you switch IT providers or an account loses its MFA, you'll spot it and can tell the customer before they find out.
What I'd steer clear of
- Ticking "yes" to everything. A signed questionnaire commits your company, and it will come back out after an incident. "Partly, finished by March" is more use to the customer than a "yes" you can't back up.
- Signing, as written, a clause that puts "all NIS2 obligations" on you. Your company isn't a NIS2 entity. Ask which specific measures they expect, and have the wording reviewed.
- Buying a certification on reflex. An ISO/IEC 27001 certificate, or a CyFun label issued after checks by an approved body, makes sense when a customer demands it in writing or several of them ask. Otherwise an honest CyFun Basic self-assessment and an up-to-date register often do the job.
- Leaving the whole thing to one person. Your IT provider knows about updates, the manager knows who has access to what, and whoever handles the accounts knows whether there's a cyber insurance policy.
Where to start this week
Download the CyFun Basic self-assessment tool from the CCB website and fill it in once without rounding up; block out half a day. Start the register with the five topics above. Then answer your customer, putting a date on whatever is still missing.
If the basics (backups, accounts, updates) aren't in place yet, I wrote up where to start in this earlier piece.
If you'd like help working through the self-assessment and the questionnaire, on a pack of hours: info@z80.be, +32 494 111 041, www.z80.be.