The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

For suppliers to NIS2 companiesany sector, all of the EU

Your customer is under NIS2. Answer once, keep it current.

NIS2 has your customer check the security of its direct suppliers, so its questionnaire reaches you even when NIS2 itself does not.

Start your compliance system Check if NIS2 applies to you

FreeFree: answer your customers' NIS2 questions onceThe free supplier profile

Example data

The rules that reach you

Why the questions come to you

NIS2 reaches you through your customer's contract, not as your own law.

NIS2, through your customer

Directive (EU) 2022/2555 · your customer's law

Your customer's duty

Your customer must manage security with each direct supplier, so its questions and contract terms come to you.

Supply chainSecurity in its relationship with each direct supplierArt 21(2)(d)
Your practicesYour vulnerabilities, product quality and security practices are weighedArt 21(3)
Contract termsSpelled out for digital and ICT customers in Implementing Regulation 2024/2690IR 2024/2690
Your customer's duty since NIS2 is your own law only if your sector and size, or your state, bring you into scope. Check yours

ISO 27001

ISO/IEC 27001:2022 · a standard

Not a law

The evidence customers usually accept for these questions, though no law requires it.

Annex A, 93 controlsYour customer sets the date

GDPR

Regulation (EU) 2016/679

If you process their data

If you process your customer's personal data, you work under an Article 28 contract with them.

Art 28Since

In numbers

How far the questions reach

590

EU tender notices mentioned NIS2 in the year to 10 October 2026.

Source: TED, the EU's tender journal, read 11 October 2026

18

NIS2 sectors whose entities must manage the security of each direct supplier.

Source: Directive (EU) 2022/2555, Annexes I and II, Article 21(2)(d)

24 of27

member states have communicated an act transposing NIS2 to the Commission.

Source: EUR-Lex, national transposition measures, read 23 October 2026

What StandardOS does for a supplier

Answer from your records, and keep every answer current

Every tile is a screen in the product today.

Questionnaires answered from your records

Paste a client's questions and each answer is drafted from your controls and evidence, with its source.

Your ISMS, drafted

ISO 27001 with its Statement of Applicability and policies drafted for you to approve.

Evidence from your own stack

12 read-only integrations, Microsoft Entra ID and Intune among them, read on a schedule.

Trust center, then the audit

Show clients where you stand, and find an accredited auditor when you want the certificate.

One subscription

Every rule on this page, on one record.

ISO27001CRANIS2DORAISO42001AIACTISO9001MRGDPRDATAACTISO27701EAAISO14001PLDREDGPSRNIS2IRRoHSREACHWEEEPPWRWBBATPTDEUDREEDCER

The 3 on this page, and 24 more for the same price

€249/mo

Every framework included.

excl. VAT, per organization

  • Unlimited users, auditors included
  • 7 days free, no card, no sales call
Start your compliance system

Questions

What suppliers ask first

Short answers, each with the article it rests on.

Does NIS2 apply to us as a supplier?

Not because you supply a NIS2 company. It applies to you if your own sector is in Annex I or II and you are medium-sized or larger, or if a rule that applies at any size, or your state, brings you in.

Art 2(1)Art 2(2)
What can our customer ask of us?

What its own measures need: security in its relationship with you, and your vulnerabilities, product quality and secure development.

Art 21(2)(d)Art 21(3)
Do we have to be ISO 27001 certified?

No law requires it. Many customers accept the certificate as the evidence for their questions, and some contracts ask for it.

Art 21(2)(d)
Our customer wants incidents reported within 24 hours. Is that NIS2?

The 24-hour early warning is your customer's duty to its authority under Article 23. Its contract with you can pass a shorter clock on, so it can meet its own.

Art 23

Answer the next questionnaire from your records.

7 days free, no card and no sales call.

Start your compliance system Check if NIS2 applies to you

This page in:DeutschFrançaisNederlandsEspañolDansk