Illustrative scenario, not a client case: a growing SaaS supplier receives a supplier-security questionnaire from a banking customer. The questionnaire mentions NIS2 and asks for evidence. The supplier is outside direct NIS2 scope. That fact matters, but it does not answer the buyer's questions or the contract review.
The useful distinction is between legal scope and a buyer's evidence request. A customer may need to manage supply-chain risk and may ask a supplier for information, contract commitments or assurance artifacts. The request can be commercially important without making the supplier an essential or important entity under NIS2.
Start with the legal boundary
The current consolidated NIS2 directive sets scope and risk-management duties for entities covered by the directive. Article 21(2)(d) addresses the security-related aspects of relationships with direct suppliers and service providers. It does not say that every supplier to a covered entity becomes covered itself.
For a Danish supplier, the Danish implementing law and the relevant competent authority guidance should be checked alongside the directive. SAMSIK's authority overview can help identify the right public authority for a sector question. None of these sources turns a customer questionnaire into a direct legal-scope determination for the supplier.
If your own entity, sector or size may put you in scope, that is a separate assessment. This article addresses the narrower situation where the customer relationship creates an evidence or contract task while your direct classification remains outside scope. NIS2 readiness for Danish SaaS covers the direct-scope question separately.
Read the buyer's request in context
A questionnaire is not the whole requirement. Read it with the service description, data-processing terms and the contract or draft contract. Establish what the customer buys, which data and systems are involved, what access your team or subcontractors have, and which parts of the request are actually tied to that service.
Look for the buyer's requested evidence, incident-notification terms, audit rights, subcontracting controls and review assumptions. Record the customer's owner and your own owner for the response. If a request is unclear, ask which risk or contract clause it is intended to address. Do not describe a buyer preference as a NIS2 obligation on your company.
Illustrative scenario: turn the request into a focused review
In the illustrative scenario, the buyer asks for a security policy, an explanation of the service boundary, access controls, incident handling, continuity evidence, security testing, sub-processors and any assurance reports. The supplier does not assume that every item applies in the same way. It connects each request to the service and checks whether the supporting artifact is current and within scope.
| Evidence area | Review question | Decision owner |
|---|---|---|
| Security policy | Does it cover the service, owner, approval and review status? | Security or technology owner |
| Service and data boundary | Which customer data, systems and environments are in the relationship? | Service owner with the buyer |
| Access controls | What access exists, who approves it, and what evidence can be shared? | Technology or security owner |
| Incident management | Which process and contract terms govern escalation and customer notice? | Technology, security and contract owners |
| Continuity and testing | What recovery assumptions and test records relate to this service? | Operations or service owner |
| Sub-processors | Which third parties can access the service or customer data? | Contract and privacy owners |
| Security testing | What testing exists, what does it cover, and what limitations apply? | Security owner or testing provider |
| Assurance reports | Is an ISO 27001 certificate, SOC 2 report or other assurance artifact held and relevant? | Compliance or security owner |
The output is a request-to-evidence map. It names the artifact, its source and date, the part of the buyer's request it supports, and the limitation that remains. It also records what is missing, who decides whether to close the gap, and whether the answer needs a contract discussion. That is useful to a buyer without pretending that the pack is a legal opinion.
Make the answer honest when evidence is missing
An evidence review should be able to say that an artifact is unavailable, partly relevant, out of date or outside the agreed service boundary. State the reason, the owner of the decision and the next action. If the buyer needs a contractual commitment that the supplier cannot support, escalate that term before signing rather than hiding it in a questionnaire answer.
Avoid copying a policy title into an answer when the policy does not cover the buyer's service. Avoid describing a planned control as if it already exists. Avoid promising a delivery date before the owner has checked the work. A precise answer gives the buyer something they can assess and gives the supplier a clear decision to make.
Use certifications as evidence, not as a legal conclusion
An ISO 27001 certificate or SOC 2 report can be relevant evidence, but its scope and assurance basis matter. Explain which entity, service and period it covers, then map it to the buyer's actual questions. If a control or obligation is not covered, say so. Certification does not make an out-of-scope supplier a NIS2 entity, and a customer's NIS2 duties do not turn a certificate into a substitute for contract review.
The same principle applies to internal policies, test summaries and continuity records. The buyer needs to know what the artifact proves, what it does not prove, and who can answer a follow-up question. The supplier needs a maintained source of truth rather than a new document for every questionnaire.
Keep the review tied to the buyer and the service
There is no universal NIS2 supplier pack that answers every buyer. The right evidence depends on the service, data, access, subcontractors, contract and assurance request. A maintained pack can reduce repeated work, but it should be adapted where the buyer's scope or terms differ.
This method does not determine your legal scope, provide legal advice, or promise that a buyer will accept the evidence. If your own scope is uncertain, obtain an appropriate legal or regulatory assessment. If the buyer request is holding up a live opportunity, the Market-access assessment can map the request to your evidence, gaps, decision owner, and next commercial step without issuing a certification or legal opinion.