Your client is in the KSC Register. Six steps before the security questionnaire arrives

Supply chain security under NIS2 is a duty of the essential or important entity to account for the risk sitting with its suppliers - which means the requirements reach companies that are not in the KSC Register themselves. The supplier receives them through a contract and a security questionnaire, not through an entry in the register.

Below are six steps for a company on the supplier side, control questions for each, and the points where a contract is easiest to lose.

Does this reach a company outside the register?

The Polish national cybersecurity system act imposes no duties on a supplier that does not meet the criteria in Article 5. It imposes them on that supplier's client, and one of them is accounting for risks arising from ICT suppliers and service providers (Article 21(2)(d) of the NIS2 directive). Biznes.gov.pl says it plainly: companies outside the scope of the act may be required to implement appropriate standards as part of the supply chain of a covered entity. Applications to the register are due by 3 October 2026, and the act allows twelve months to implement risk management measures, so until 3 April 2027.

Step 1: Clients - which of them is covered by the act?

Start with your own client list, not with the legislation. It tells you how much time is left and who will ask first.

Control questions: Which clients operate in the sectors listed in Annex 1 or Annex 2 - energy, transport, banking, health, digital infrastructure, public administration, waste, food, manufacturing? Is any of them critical to our revenue? Does our service touch their systems, their data or their continuity? Does anyone here own security contacts?

If even one major client sits in those sectors, the question is not whether the questionnaire arrives, but when.

Step 2: Contracts - what have we already signed?

Requirements usually reach a supplier as an addendum or a new clause at renewal. It pays to know what you have already promised.

Control questions: Do the contracts contain information security provisions, and if so, which exactly? Have we committed to a response time or to notifying the client of an incident? Does the client hold audit rights or the right to request documentation? Has anyone checked whether we can actually deliver on those clauses?

The worst case is a clause signed a year ago that nobody turned into a procedure - the first incident exposes it within hours.

Step 3: Incidents - can we make the client's deadlines?

A client covered by the act has 24 hours for an early warning, 72 hours for the notification proper and 30 days for the final report, counted from detection. If your service is the source, their clock starts when you tell them.

Control questions: Do we have one channel through which the client is notified, and who triggers it? How many hours would it take us to confirm something happened outside working hours? Do we know what the client has to include in the first notification? Has anyone rehearsed this even once?

The client's deadlines are statutory, so your response time has to be shorter. We set them out in our article on NIS2 incident reporting.

Step 4: The answer pack - what do we need to be able to show?

Security questionnaires differ in form but ask the same things. A pack prepared once cuts the answer from two weeks to a day.

Control questions: Can we describe how we protect client data and who has access to it? Have we named someone accountable for cybersecurity? Do we know where the data physically sits and who our cloud provider is? Do staff take security training, and can we evidence it? Do we hold backups, and when did we last test a restore?

"We are working on it, the deadline is March" is a defensible answer. Silence or a generality is not.

Step 5: Subcontractors - where does our chain end?

The directive requires looking at the quality of a supplier's practices and at its own vulnerabilities (Article 21(3)). In practice the client asks about the companies standing behind you.

Control questions: Which of our subcontractors have access to client data or systems? Have we passed the same contractual requirements on to them? Do we know where our tools process data, and whether a provider has been designated high-risk? Do we hold that list in one place, kept current?

The chain ends where your knowledge of it ends - and that is usually exactly where the client's question begins.

Step 6: Evidence - what remains after this work?

A questionnaire is a declaration. What counts is what stands behind it, because in an incident or an audit the client reaches for documents, not the form.

After this step the organisation should hold:

• a list of clients in covered sectors, with an assessment of how critical your service is to them;
• a contract review with security commitments marked up;
• a client notification procedure with a response time shorter than their deadlines;
• a ready description of controls, roles and data locations;
• a list of subcontractors with access to client data;
• records of training and of backup restore tests.

Essential entities have twenty-four months to their first audit, until 3 April 2028. At that point questions about suppliers stop being a questionnaire and become part of someone's audit.

On your own or with a tool?

The six steps above need no system at all: a client list, a contract review, one procedure and a handful of records. The difficulty starts with upkeep, because new clients arrive, subcontractors change, and training has to be repeated and evidenced.

That is the part Cyber TrustCERT handles: training for staff and management with an exam, policy and procedure templates, and reporting you can answer client questions with. If you are not sure where to start, Cyber Ready Check gives a first diagnosis in minutes - the result is computed in your browser and stored nowhere.

Summary

Preparing as a supplier comes down to six questions: which clients are covered by the act, what we have already signed, whether we can notify the client ahead of their deadline, what we can show in a questionnaire, who stands behind us in the chain, and what evidence remains afterwards.

The statutory duty belongs to the client, but the cost of failing it also lands on the supplier who cannot answer. A prepared company sends the pack back in a day and wins the comparison. An unprepared one learns about the requirements during a tender it can no longer win.

This article walks through the preparation, but does not settle any organisation's status or the scope of a contract - the parties do that, and where there is doubt, confirm the assessment with a lawyer.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.