You’re not in scope for NIS2 — yet you still get that questionnaire
More and more SMEs are being contacted with questions about their digital security. Not because they fall under the law, but because a larger customer is asking. How does that work?
How can that be?
Under the new Dutch Cybersecurity Act (the Dutch implementation of the EU NIS2 directive), larger and critical organisations must not only have their own security in order, but also look at their entire supply chain. A hospital, energy company or large client is legally required to assess and manage the risks at its suppliers.
The result: those organisations impose requirements on their suppliers. A questionnaire, an audit, or a clause in the contract. And that is how you — the supplier — end up indirectly in NIS2, even if you’re not in scope yourself.
What the official tool won’t tell you
The government has an official NIS2 self-assessment. It answers exactly one question: am I in scope, yes or no? For most SMEs the answer is “no”.
But that’s exactly where the confusion sits. Because while the tool says “you don’t have to comply”, your customer’s questionnaire is already on the table. Not having to comply with the law is not the same as not having to prove you work securely.
For SMEs it’s not the law that makes it urgent — it’s your customer.
What does this mean for you in practice?
Good news: you don’t need to build a compliance department. It’s about a solid foundation you want anyway: two-factor authentication (MFA), tested backups, timely updates, an overview of who has access, and a simple plan for when something goes wrong.
And the proof towards your customer? That’s what the sector-wide NIS2 Cyber Score is for — a self-declaration you can share. Bureau Mos IT helps you reach that score and get the basics genuinely in order, without fuss.
Curious where you stand?
Getting security questions from customers, or unsure whether you need to act? One level-headed conversation often brings clarity — no scaremongering.