NIS2 Supplier Questionnaires: Building an Evidence Pack as a North American OT Vendor

NIS2 does not regulate you if you are a control system vendor in Houston or a systems integrator in Calgary. It regulates your European customers. But Article 21(2)(d) requires those customers to manage cybersecurity in their supplier and service provider relationships, and the only tool they have for that is a questionnaire sent to you. That is how an EU directive becomes your problem.

Most vendors handle this badly, and the failure mode is consistent: every questionnaire is answered from scratch by whoever has capacity, answers drift between submissions, and nobody can produce the evidence behind the claims when a customer audits. The fix is to build the evidence pack once and answer from it. Our supply chain cyber risk assessment playbook describes the same process from the buyer's side, which is useful context for understanding what they are actually testing.

What your customer is required to assess

Article 21(2)(d) is short and broad. It requires entities to address supply chain security, including security related aspects of the relationships between the entity and its direct suppliers or service providers. In practice their questionnaire will test four things.

• Can you be compromised in a way that reaches them. Your development environment, your remote access, your update channel.
• Is your product secure enough to deploy in their environment. Secure defaults, authentication, patchability.
• Will you tell them when something goes wrong. Disclosure policy, notification commitments, contact points that work.
• Can you prove any of the above. This is where most vendors fail, and it is the only question that matters at audit.

The nine documents that answer most questionnaires

Document	What it has to do
Software bill of materials	Per product, per released version. Turns component questions into a lookup instead of an investigation.
Secure development statement	Your SDL mapped to IEC 62443-4-1. The single highest leverage document on this list.
Product security baseline	Default configuration, authentication, cryptography, logging, per product family.
Vulnerability disclosure policy	Published, with a contact point that is monitored and a stated response window.
Notification commitment	What you tell customers, how fast, through which channel. Align this with your CRA Article 14 duties.
Support and end of life policy	How long each product receives security updates, published rather than negotiated per deal.
Remote access procedure	How your engineers reach customer environments. Scrutinized harder than anything else on this list.
Subcontractor register	Who you depend on, and what they can reach. Your customer owes a fourth party answer whether you provide one or not.
Incident response summary	A one page extract of your plan, suitable for sharing without exposing internals.

 

The SBOM is the unlock. Without it, component level questions take days each. Our guide to SBOM for OT supply chain and procurement covers generation and maintenance on industrial products.

The answer that loses deals When a vendor writes "this information is confidential" against a security question, procurement reads it as "we do not have it." You can withhold internals and still answer well: share the policy rather than the configuration, the control rather than the credential, a summary rather than the full plan. Refusing outright is what gets you scored down.

 

Where IEC 62443 does the heavy lifting

If you have 62443-4-1 certification for your development process or 62443-4-2 for component security, say so in the first line of every response. European operators recognize it, auditors accept it, and it collapses twenty questions into one reference. If you do not have it, mapping your existing practices to the 62443-4-1 practice areas still gives you a defensible structure, and it is the single best investment a vendor can make here. Our IEC 62443 guide covers the structure of the series.

Make it reusable

Build a single answer library keyed to question themes rather than to customers. When a new questionnaire arrives, you are editing rather than writing. Review the library quarterly, version it, and name one owner. Vendors who do this answer in days instead of weeks, and the consistency itself reads as maturity to a procurement team comparing you against competitors who contradict themselves between submissions.

One more thing that pays off: offer the pack before you are asked. A vendor who sends an evidence pack with the proposal is answering a question the buyer has not yet raised, and it shortens their assessment cycle. That is a commercial advantage, not a compliance cost.

Why Choose Arista Cyber

We sit on both sides of this conversation. We help asset owners assess vendors and we help vendors build the evidence to pass that assessment, which means we know what actually gets scored and what gets skimmed. We work to IEC 62443 on product and system security, and our consultants carry functional safety credentials on the same assets. See our case studies for how this runs on real engagements.

Next Steps

If you are answering European questionnaires one at a time, the evidence pack pays for itself in the first two submissions. Start with the SBOM and the secure development statement, because those two unlock the largest share of questions. Then build the answer library around them.

Common Questions

Do we have to comply with NIS2 as a non-EU supplier?

Not directly. NIS2 binds your EU customers. It reaches you contractually, through the supply chain obligation in Article 21(2)(d). The practical effect is the same, but the legal route matters when you negotiate contract language.

Can we refuse to answer parts of a questionnaire?

You can, but expect to be scored down. A better approach is to answer at a level that satisfies the control question without exposing sensitive internals.

Does IEC 62443 certification satisfy NIS2 supplier requirements?

It does not discharge your customer's obligation, but it is the strongest single piece of evidence you can offer and it substantially shortens their assessment.

What about our own subcontractors?

Your customer owes an answer on fourth party risk. If you cannot describe your subcontractors and what they can reach, that gap becomes their finding and your problem.

How does this relate to our CRA obligations?

They reinforce each other. The SBOM, disclosure policy and support period you build for the Cyber Resilience Act are the same artifacts a NIS2 questionnaire asks for, so build them once.

Answering the same security questionnaire for the fifth time? Arista Cyber builds reusable NIS2 and CRA evidence packs for North American OT vendors: SBOM capability, secure development statement mapped to IEC 62443-4-1, disclosure policy and a versioned answer library. Build your evidence pack