Why is your customer asking?

Four texts make your customer answer for the security of its suppliers.

1. Directive (EU) 2022/2555 (NIS2), Article 21(2)(d) and 21(3)^[1]Supply chain security, including the security of their relationships with each direct supplier and service provider, taking into account each supplier's vulnerabilities and the overall quality of its products and cybersecurity practices, including its secure development procedures.
2. Implementing Regulation (EU) 2024/2690, Annex, section 5^[2]Applies to DNS, cloud, data centre, content delivery, managed and managed security service providers, TLD registries, online marketplaces, search engines, social networks and trust service providers.A supply chain security policy with criteria for choosing suppliers (5.1.2), security terms in each contract (5.1.4), regular monitoring of suppliers (5.1.6 and 5.1.7) and a directory of direct suppliers with the ICT products and services each provides (5.2).
3. KYA 1689/2025, Article 12^[3]Applies to Greek essential and important entities.Risk management of relationships with suppliers and ICT service providers.
4. Regulation (EU) 2022/2554 (DORA), Articles 28 and 30^[4]Applies to financial entities, from banks to insurers, for their ICT providers.Due diligence before contracting (28(4)), only providers that comply with appropriate information security standards (28(5)), a register of every ICT arrangement (28(3)), audit rights (28(6)) and a written contract with the provisions Article 30 lists.

If you provide ICT services to a financial entity, DORA Article 30 decides much of your contract: where the service runs and its data is stored, help when an ICT incident occurs, cooperation with its authority, termination rights and, for a critical or important function, tested contingency plans, access and audit rights and a transition period on exit.

What does the questionnaire ask?

Most questionnaires group their questions like this, each group with the evidence that answers it.

1. Company, certification and scopeWho you are, which services you provide and whether an ISO/IEC 27001 certificate or audit report covers them (Annex 5.1.4(e); DORA Article 28(5)).Evidence: The certificate with its scope, the Statement of Applicability and the latest audit report.In Vardion: the certificate's scope by service and the Statement of Applicability.
2. Policies and governanceWhether your security policies are approved, who is responsible for security and when management last reviewed them.Evidence: The policy set with approval dates, the security officer's appointment and the latest management review.In Vardion: 16 policy and procedure drafts, the policy index and management reviews.
3. Risk managementHow you assess and treat risk, and how you handle exceptions to your own policies.Evidence: The risk procedure, the risk register and the exception register.In Vardion: risk and exception registers, with drafts of both procedures.
4. Assets, architecture and data locationWhich systems carry their service, how your network is laid out and where their data is stored and processed (DORA Article 30(2)(a) and (b)).Evidence: The asset inventory, the architecture diagram and the countries where data is stored and processed.In Vardion: an asset register from scans and agents, with an architecture drafted from your networks.
5. Access and authenticationWhether multi-factor authentication is enforced, how privileged access is controlled and how leavers lose access (NIS2 Article 21(2)(i) and (j)).Evidence: The access control policy and your identity provider's settings.In Vardion: multi-factor authentication read from Microsoft 365 or Google Workspace.
6. Vulnerabilities, testing and developmentHow often you scan, how fast you fix critical vulnerabilities, when you were last penetration tested and how you develop securely (NIS2 Article 21(3); Annex 5.1.4(f)).Evidence: Scan results, fix times, the latest penetration test report and the secure development procedure.In Vardion: scheduled scans with measured fix times and imported penetration test findings.
7. IncidentsHow you handle incidents and how soon you will tell them about one that affects them (Annex 5.1.4(d); DORA Article 30(2)(f) and 30(3)(b)).Evidence: The incident procedure, the incident register and the notification term in your contract.In Vardion: an incident register that works out every reporting deadline.
8. Continuity and exitWhether your continuity and recovery plans are tested, and how their data comes back when the contract ends (Annex 5.1.4(h); DORA Article 30(2)(d) and 30(3)(c) and (f)).Evidence: The continuity plan, the latest test results and the exit plan.In Vardion: an impact analysis with recovery objectives and 6 tabletop scenarios.
9. Your own suppliersWhich subcontractors take part in their service and how you check them (Annex 5.1.4(g); DORA Article 30(2)(a)).Evidence: The subcontractor list and your own supplier assessments.In Vardion: a supplier register with weekly grades and questionnaires.
10. People and trainingWhether your staff are trained and background-checked, and how they take part in your customer's security awareness programme (Annex 5.1.4(b) and (c); DORA Article 30(2)(i)).Evidence: Training records, phishing simulation results and the background check procedure.In Vardion: phishing simulation and training results by department.
11. Personal dataWhat personal data you process for them, where and under what safeguards (DORA Article 30(2)(c)).Evidence: The record of processing activities, impact assessments and the data processing agreement.In Vardion: processing records, impact assessments and a data protection policy draft.

Answer your customer's questionnaire in Vardion

• Start from a supplier due diligence or DORA template, or paste your customer's own list.
• Name the record that answers each question, from the asset register to the DORA register.
• Send the list to the colleague who knows the answers. They reply in words and files, and you accept each answer or send it back with a note.
• Send a pack of every answer and file, with a checksum for each file.

Sources

1. Directive (EU) 2022/2555 (NIS2), Article 21, checked 24 October 2026
2. Implementing Regulation (EU) 2024/2690, Annex, section 5, checked 24 October 2026
3. KYA 1689/2025 (ΦΕΚ Β' 2186/2025), Article 12, the authority's copy, checked 24 October 2026
4. Regulation (EU) 2022/2554 (DORA), Articles 28 and 30, checked 14 October 2026