FrenchCybersecurity
NIS2 · Supplier risk · Belgium
NIS2 and IT suppliers in Belgium: 15 pieces of evidence to verify in 2026
NIS2 IT suppliers: a completed questionnaire is not enough without dated evidence. A supplier can be commercially reliable while still creating a poorly managed cyber dependency. For NIS2, a completed questionnaire is not enough: the organisation must link each third party to a critical service, request verifiable evidence and track gaps. This approach helps management, procurement, IT and compliance teams assess MSPs, SaaS providers, cloud providers, hosting providers and subcontractors without turning every contract into an excessive audit.
NIS2 IT suppliers: what the directive actually requires
NIS2 requires supplier risk management, not the mechanical collection of an identical dossier for every service provider. Article 21 of the European Directive refers to supply chain security, including aspects relating to the relationships between an entity and its direct suppliers or service providers. It also requires an all-hazards approach that is appropriate and proportionate.
The official page of the CCB dedicated to the NIS2 Act confirms this obligation in Belgium. It states that the entity must consider the vulnerabilities specific to each direct supplier, as well as the overall quality of its products and cybersecurity practices, including secure development procedures where applicable.
Purchase, logistics and personal use policy needed.
4. Company-owned device GVISION’s audit and evidence collection methodology explains the difference between an indication, a finding and a recommendation.
Classify suppliers before sending them a questionnaire
Criticality is measured by impact and exposure, not by the value of the invoice. A small service provider with an administrator account may represent a greater risk than a large office supplies provider. Start with a third-party register: service provided, internal owner, data, systems, access, known subcontractors, hosting countries, dependencies and replacement solution.
Ask four questions. Can the supplier interrupt an important activity? Can it read, modify or delete sensitive information? Does it have remote, privileged or permanent access? Would it be difficult to replace within the timeframe acceptable to the business? The more positive answers there are, the more recent, precise and verifiable the evidence should be.
A simple classification often works better than a complex model. The critical level covers services whose failure would cause a major outage, widespread compromise or difficult recovery. The high level concerns significant access or sensitive data with limited fallback options. The standard level covers replaceable, weakly connected services with no significant access.
The 15 pieces of evidence to verify from an IT supplier
4. Company-owned device An old document or one limited to a subsidiary may be accurate without covering your service.
1. Governance and security owner
Request an approved security policy, its review date and the responsible role. The document should not disclose internal secrets; it should demonstrate that responsibilities exist, management oversees risks and exceptions are addressed. For a critical service, also verify the frequency of reviews and escalation to management.
4. Company-owned device
Purchase, logistics and personal use policy needed.
3. Privileged access inventory
The supplier must explain who can administer your environment, through which channel, with what level of privilege and for how long. Look for named accounts, phishing-resistant multi-factor authentication where possible, a secrets vault, temporary privilege elevation and an emergency procedure. Request an anonymised example of an access review rather than a simple statement.
4. Joiners, role changes and leavers
Verify the process for granting and removing accounts for employees and subcontractors. Useful evidence may include a redacted sample of an onboarding and offboarding ticket, with approval and timing. Also check devices, API keys, tokens and out-of-band access that may sometimes remain active after the main account has been removed.
5. Vulnerability and patch management
Request the scanning, assessment and remediation policy, as well as recent high-level results. Remediation timelines should vary according to severity, exposure and whether active exploitation exists. A report without an action plan is not sufficient: verify exceptions, compensating measures, owners and target dates.
6. Secure development and change management
For a software vendor, agency or bespoke integration, look for code review, dependency management, environment segregation, secrets kept out of code, pre-production testing and change approval. Ask how reported vulnerabilities are received and handled. An SBOM can help for certain software, but its presence alone does not prove that the components are secure.
7. Logging and monitoring
Verify which administrative actions, connections, changes and security events are logged, how long logs are retained and who monitors them. Request an anonymised example of a report or alert. Logs must be able to support an investigation without being accessible to the same accounts that could potentially alter them.
8. Incident detection and response
Mobile Application Management applies rules to work applications and business data without placing the whole endpoint under device management. Microsoft describes MAM for unenrolled devices as a way to combine application configuration and protection. On supported apps, policies can require an app PIN, restrict copying to personal apps, limit local storage and selectively remove organisational data.
9. Notification and cooperation
The supplier's contractual notification must arrive early enough to allow your organisation to assess its own obligations. Do not automatically specify “24 hours” everywhere: define the trigger, minimum information, updates and secure channels according to the service. The directive provides for relevant entities to issue an early warning within 24 hours of becoming aware of a significant incident, followed by further steps; your contract must leave enough time to decide and notify.
10. Backup, recovery and segregation
A backup policy does not prove recoverability. Request the scope, retention period, protection against modification, account segregation and the results of a restoration test. Also verify who backs up what: in a SaaS environment, the supplier often protects the platform without guaranteeing your required level of granularity, business retention or export.
11. Business continuity and recovery
Look for an impact analysis, defined recovery objectives, a tested plan and identified dependencies. Compare RTO and RPO with business requirements rather than marketing claims. Ask what happened during the last exercise, what gaps were identified and whether they have been remediated.
12. Subcontractors and cascading supply chains
The supplier must be able to identify subcontractors that actually contribute to the service, their role, location and the mechanism for notification of changes. The objective is not to know every office supplies provider, but to identify dependencies capable of affecting availability, confidentiality, integrity or incident response.
4. Company-owned device
An ISO/IEC 27001 certificate, a CyberFundamentals attestation or an assurance report can reduce the effort if the document is valid and covers the service. Examine the issuing body, dates, sites, activities, exclusions and any qualifications. A certification does not eliminate risks specific to your configuration, access or contract.
14. Data protection and retention
When the supplier processes personal data, verify the data processing agreement, data categories, retention period, assistance with data subject rights, security measures and transfers. GDPR and NIS2 overlap in certain practices without being interchangeable. Involve the DPO or legal counsel for complex clauses and transfers.
15. Reversibility, deletion and exit
Ask how data and configurations can be exported, in what format, within what timeframe and at what cost as verified in the contract. Provide for access revocation, asset return, certified deletion and transition assistance. A highly secure service that cannot be exited remains a continuity risk.
Tailor the depth of review to the risk
The best control is one that reduces significant uncertainty without unnecessarily requiring sensitive documents. A short self-declaration may be sufficient for a standard service. A high-risk supplier warrants targeted evidence and an interview. A critical supplier justifies a deeper documented review, testing, independent assurance or a controlled right to audit.
| Level | Evidence | Advantages | Limitations | Best choice according to the need |
|---|---|---|---|---|
| Standard | Declaration, service information sheet, contacts, minimum clauses. | Quick and proportionate. | Limited assurance. | Replaceable service, with no sensitive access. |
| High | Targeted documents, samples, interview, action plan. | Verifies the controls most exposed to risk. | Depends on the quality of the evidence. | Sensitive data or significant access. |
| Critical | In-depth review, testing or independent assurance, with enhanced monitoring. | Better-supported confidence and traceability. | More costly; confidentiality must be managed. | Major business outage, high privileges or difficult replacement. |
| Best choice | Classify the risk first, then increase the level of evidence and monitoring frequency only where the impact justifies it. | |||
Turn findings into clauses and decisions
An assessment without contractual translation leaves the main risks without effective leverage. 4. Company-owned device
At a minimum, address access, confidentiality, incident notification, cooperation, continuity, backups, subcontractors, significant changes, reversibility and deletion. Define who can request evidence, with what notice and what confidentiality protections. An absolute right to audit may be unrealistic with a large SaaS provider; an independent report, an assurance meeting and targeted evidence can be alternatives.
Organise a repeatable supplier review
An effective review follows a common workflow across business, procurement, IT, security, legal and DPO teams. The business owner describes the use case and impact. IT confirms integrations and access. Procurement obtains the documents and negotiates. Security assesses the controls. Legal and the DPO handle clauses within their respective areas of responsibility.
Company device
Belgian scenarios
Supplier programmes fail when they accumulate forms without improving decisions.
- Send 200 questions to everyone. Fatigue produces generic responses and slows down procurement.
- Confuse a declaration with evidence. Request a relevant sample, not an undated “yes”.
- 4. Company-owned device The service or region may be excluded.
- Purchase, logistics and personal use policy needed. Emergency accounts, RMM tools and partner consoles are critical.
- Set the same deadlines for everyone. Remediation must take severity, exposure and compensating measures into account.
- Ignore the cascading supply chain. A robust supplier may depend on a poorly documented critical subcontractor.
- Never test the exit process. A theoretical export may be incomplete, unreadable or too slow.
- File the dossier after signature. Without monitoring, evidence expires and exceptions become permanent.
A realistic 30-day action plan
Within one month, an organisation can identify its main third parties, define its requirements and launch priority reviews. It cannot guarantee the compliance of an entire complex supply chain within four weeks.
Week 1: inventory and classify
Gather contracts, invoices, SSO connections, administrator accounts and applications. Assign a business owner. Classify impact, data, access and replaceability. Select five to ten suppliers that concentrate the risk, rather than starting alphabetically.
Week 2: request targeted evidence
4. Company-owned device
Week 3: analyse and decide
Compare the evidence with the risks and commitments. Formulate each gap in terms of impact, recommendation, owner and date. Have exceptions accepted by the appropriate level of authority. For a multi-site environment or several critical service providers, a Professional Audit can structure evidence collection, findings and a prioritised roadmap without presenting the exercise as a certification.
Week 4: formalise contracts and monitor
Update clauses during renewal or through an amendment where necessary. Record actions, review dates and trigger events. Present uncovered risks, dependencies without an exit solution and decisions required to management.
Common mistakes
Are all suppliers of an NIS2 entity themselves subject to NIS2?
Limitation
Is an ISO 27001 certificate sufficient to accept a supplier?
4. Company-owned device
Can you request a full penetration testing report?
You can request assurance, but a detailed report often contains sensitive information. Depending on the risk, prefer a summary, remediation attestation, controlled meeting or redacted extract. The requirement should be proportionate and confidentiality conditions should be defined.
How often should a critical supplier be reviewed?
Set a frequency based on risk and add triggers: incident, subcontractor change, new region, architecture change, acquisition, expired certificate or expanded access. An annual review can serve as a baseline, but does not replace reassessment after a significant event.
What should you do if a large SaaS provider refuses the questionnaire?
Use its trust centre, independent reports, certifications, contracts and continuity information. Identify the remaining gaps, adjust configuration and data, negotiate where possible, or formally accept the risk. Refusal does not relieve your organisation of the need to make a decision.
Does a free self-assessment constitute a NIS2 audit?
Limitation
Who should approve the acceptance of supplier risk?
The level of approval should follow the organisation's governance and the severity of the risk. IT should not accept alone a risk that could interrupt an essential activity, expose sensitive data or involve senior management. Document the decision-maker and the duration of the acceptance.
From questionnaire to a defensible decision
The value of a supplier review lies not in the number of boxes ticked, but in the ability to explain why a service is acceptable, under what conditions and until when. GVISION can help map dependencies, examine evidence and turn gaps into a roadmap. To frame a first proportionate review, talk to the GVISION team about your critical suppliers.