Your customer is asking for NIS2 evidence?
From customer request to a signature-ready evidence PDF in 14 days: status of all 10 measures under Section 30 BSIG, your policies, contact person and reporting channel. No consultant, no audit.
Why your customer is suddenly asking
The customer is obligated, not you
Section 30 (2) no. 4 BSIG obliges NIS2-regulated companies to secure their supply chain. They must show that their service providers and suppliers have cybersecurity under control.
The obligation is passed down by contract
Procurement and compliance handle this with questionnaires, contract clauses and evidence requirements. Anyone who delivers nothing ends up on the risk list — and under review at the next framework contract.
Answering fast and structured keeps the contract
The customer needs a document for their file, not a presentation. Whoever sends a clean status per measure within two weeks is through. Whoever needs three months gets replaced.
What is typically requested
Supplier questionnaires follow the 10 measure areas from Section 30 (2) BSIG. The evidence covers exactly these — point by point.
- 1Risk Analysis and Security Policies§30 Abs. 2 Nr. 1 BSIG
- 2Incident Handling§30 Abs. 2 Nr. 2 BSIG
- 3Business Continuity§30 Abs. 2 Nr. 3 BSIG
- 4Supply Chain Security§30 Abs. 2 Nr. 4 BSIG
- 5Security in Acquisition, Development and Maintenance§30 Abs. 2 Nr. 5 BSIG
- 6Assessment of Cybersecurity Measures Effectiveness§30 Abs. 2 Nr. 6 BSIG
- 7Basic Cyber Hygiene and Training§30 Abs. 2 Nr. 7 BSIG
- 8Cryptography and Encryption§30 Abs. 2 Nr. 8 BSIG
- 9Human Resources Security and Access Control§30 Abs. 2 Nr. 9 BSIG
- 10Multi-Factor Authentication and Secure Communication§30 Abs. 2 Nr. 10 BSIG
Your path in 14 days
Three steps, each with a result in hand.
- 1
Maturity check (day 1)
13 questions, 3 minutes. You immediately see where you stand in the 10 areas and what a customer would flag.
Free, no login
- 2
Gap analysis in the trial (days 2–10)
Your check answers are pre-filled. You assess the 10 measures in detail and create missing policies with the document generator.
Free trial
- 3
Evidence PDF (days 11–14)
Enter contact person, recipient and classification, generate the PDF, sign it, send it to the customer. Regenerate at any time when your status changes.
From Starter, €99/month
What the evidence contains
- Status per measure — implemented, partial, planned — for all 10 areas under Section 30 BSIG
- Maturity level per measure from your gap analysis
- List of your policies and documents with dates
- Contact person for security questions and reporting channel for incidents
- Training status of your employees and BSI registration status
- Declaration with date, validity and signature field
To be clear: the evidence is a self-declaration — not a certification, not an audit. For most supplier questionnaires that is exactly what is needed. If your customer requires ISO 27001 or TISAX, the evidence is the first step, not a replacement.
Start the free maturity checkFrequently asked questions
Is a self-declaration enough for my customer?
In most cases, yes. Customers must assess the security of their supply chain under Section 30 (2) no. 4 BSIG — for that they need reliable information, not a certification. If your customer explicitly requires ISO 27001 or TISAX, the evidence is the first step towards it.
Do I have to fall under NIS2 myself?
No. The evidence is designed for companies that are not regulated themselves but supply NIS2-regulated customers. In the evidence you choose the matching classification: regulated, supplier or not affected.
What if I have not implemented all measures yet?
Then the evidence says so: "partially implemented" or "planned". That is normal for customers — they want to know where you stand and that you are working on it. An honest status with a plan is worth more than an empty questionnaire.
How long is the evidence valid?
You choose 6 or 12 months. If your status changes, you generate a new version in two minutes — the data comes from your continuously maintained gap analysis.
Start with the free maturity check
3 minutes, 13 questions, no login. Afterwards you know what your customer will see — and what you should close beforehand.
The evidence is a self-declaration and does not replace legal advice, a certification or an audit.