The questionnaire comes before the contract
Many clients ask suppliers to complete security questionnaires and attach technical evidence before signing.
NIS2 · Supply chain security · From €490
NIS2 and supplier security: a documented verification you can hand over
The NIS2 Directive, transposed in Italy by Legislative Decree 138/2024, requires organisations to manage cyber risk, including the security of their supply chain (Art. 21). We help you produce the technical proof your client or authority asks for: a test, a report and a signed attestation.
What NIS2 asks for, in practice
The directive does not name a single test. It asks for technical and organisational measures proportionate to the risk, and the ability to demonstrate that they work. Among them are vulnerability handling, the security of systems that are acquired or developed, and supply chain security.
For a NIS2 entity this means being able to show, with evidence: which exposed systems it has, how it verifies them, how it handles the vulnerabilities it finds and how it controls its suppliers. Penetration testing and vulnerability assessment produce exactly this evidence, for the technical part.
Why the supply chain becomes a problem
A NIS2 entity is also responsible for what its suppliers put online on its behalf. An application built by an agency, a portal run by a partner, a payment service integrated into a flow: if they have a vulnerability, the client carries the consequences.
Verification becomes a requirement
In specifications and at renewal, a request for a documented security verification is increasingly common.
A supplier incident is your incident
For the client, responsibility stays with it even when the vulnerable system is run by a third party.
Proof must be dated and repeatable
An attestation two years old, on a system that has since changed, proves nothing. That is why a cycle is needed.
What our verification covers, and what it does not
A credible verification needs clear boundaries. They are the same boundaries a careful client will ask about.
Covers: exposed web surfaces
Public websites and applications within the authorized perimeter, with penetration testing and manual validation of vulnerabilities.
Covers: configuration and components
Component versions, configurations, security headers and exposed information, checked against published vulnerabilities.
Does not cover: the management system
Risk analysis, policies, roles, training and governance are not part of the test. They are the other measures NIS2 requires.
Does not cover: internal tests and infrastructure
Internal networks, segmentation and cloud infrastructure are separate services, quoted on request.
Who needs this verification
Three recurring situations, with different needs.
The NIS2 entity
It must demonstrate controls over its exposed systems and over vulnerability management. The report is one of the pieces of evidence for its risk management system.
The supplier of a NIS2 entity
It receives security questionnaires and verification requests from its client. A signed and dated report speeds up the answer and reduces follow-up questions.
Bidders for tenders and renewals
The specification asks for a documented verification as a requirement. The signed letter is the proof that the requirement was met at the date of the offer.
How a supply chain verification is prepared
The typical path, from the first contact to the delivered proof.
1. Define the perimeter
We identify which of the supplier's systems the client relies on: usually the portal, application or API that handles its data or services.
2. Choose the level of testing
A vulnerability assessment for coverage, a penetration test for critical applications, or both in the same cycle.
3. Test and document
The test runs under written authorization. The report documents method, dates, outcomes and the corrective plan.
4. Fix and re-verify
Corrected vulnerabilities are re-verified. The final proof shows the state after the fixes, not only the original problem.
How to answer questionnaires honestly
The report does not answer a questionnaire on its own, but it gives you the data to answer it precisely.
- When the last test was run, with which perimeter and method.
- How many vulnerabilities emerged by severity, and how many are closed after the retest.
- Which process governs the fixes: priorities, owners, timelines.
- When the next verification cycle is scheduled.
Do not declare NIS2 compliance on the basis of a single test. It is a technical proof, to be placed within a wider framework.
How much it costs
The Single perimeter plan costs €490 one-off, VAT excluded, for one primary domain with its subdomains. For NIS2 entities and extended perimeters, the Enterprise plan starts at €4,900 one-off, with a perimeter agreed in writing, an NDA and a dedicated contact. The full price list is on the home page.
Frequently asked questions on NIS2 and suppliers
Does a supplier of a NIS2 entity need a penetration test?
It depends on the contract and on the risk of the service. Clients often ask for a documented verification. We help you define the most useful perimeter and the right level of testing.
Is a penetration test enough for NIS2?
No. NIS2 requires a set of risk-management measures, from governance to training. The penetration test is one of the technical proofs that support those measures.
What does the report contain for the client?
The perimeter tested, the method, the dates, the outcomes by severity, the confirmed vulnerabilities, the corrective plan and the retest. Plus the signed letter of attestation.
How much does it cost for a supplier?
The single perimeter costs €490 one-off, VAT excluded. For NIS2 entities and extended perimeters the Enterprise plan starts at €4,900.
How long does it take to get the proof?
The report arrives within 5 working days of the signed authorization. The free re-verification is included within 30 days.
Is the verification needed if a third party hosts the system?
It depends on who runs the system and who answers for it. If the supplier is responsible for the exposed service, the verification covers its perimeter. We clarify the perimeter before starting.
How often should it be repeated?
At least once a year and after significant changes. For perimeters that change often we propose scheduled cycles every 4 or 6 months, with a comparison between one cycle and the previous one.
Need a verification for a client or a NIS2 questionnaire?
Send us the perimeter: we tell you in writing what is needed and what we would verify, with a tailored proposal.
Request a proposal