Kwestionariusz dla dostawców NIS 2

Zarejestrowana nazwa Twojej firmy, taka jak widnieje w rejestrze handlowym. Przykład: Müller GmbH lub Acme Software Ltd.

Podstawa prawna: CIR 2024/2690 §5.2

Zarejestrowany adres prowadzenia działalności Twojej firmy. Wystarczy jeden adres, nawet jeśli masz kilka lokalizacji.

Podstawa prawna: CIR 2024/2690 §5.2

Kraj, w którym Twoja firma ma siedzibę prawną. Dwie litery, np. DE dla Niemiec.

Podstawa prawna: CIR 2024/2690 §5.2

Twoja domena główna, zwykle adres URL Twojej witryny. Przykład: acmesoftware.com.

Podstawa prawna: CIR 2024/2690 §5.2(a)

One paragraph on what you deliver to customers: concrete products, services or work, not marketing. Examples: “Office cleaning three evenings a week, with keys to the building” or “Payroll accounting for up to 200 employees”.

Podstawa prawna: CIR 2024/2690 §5.2(b) · ISO/IEC 27001:2022 A.5.19, A.5.22

Osoba, z którą klienci kontaktują się w przypadku incydentu bezpieczeństwa. W mniejszych firmach często dyrektor zarządzający lub kierownik IT. Wystarczy jedna osoba.

Podstawa prawna: CIR 2024/2690 §5.2(a) · ISO/IEC 27001:2022 A.5.20, A.5.24

Adres e-mail, którego klienci używają do zgłaszania incydentu bezpieczeństwa. Najlepiej lista dystrybucyjna, taka jak security@example.com, która dociera do wielu osób.

Podstawa prawna: CIR 2024/2690 §5.2(a) · ISO/IEC 27001:2022 A.5.20, A.5.24

Phone number for urgent incident reports. Add the hours it is answered in brackets; round-the-clock cover is not expected.

Podstawa prawna: CIR 2024/2690 §5.2(a) · ISO/IEC 27001:2022 A.5.20, A.5.24

At most this many hours after you notice a security incident that affects a customer, for example a data leak, a hacked account or a lost key. A customer under NIS 2 must send its authority an early warning within 24 hours of becoming aware of a significant incident (Art. 23(4)(a) NIS 2), so a promise of 24 hours or less helps them most. Give a value you keep.

Podstawa prawna: CIR 2024/2690 §5.1.4(d) · ISO/IEC 27001:2022 A.5.20, A.5.24

Uruchamiasz oprogramowanie dla klientów na własnej infrastrukturze i dostarczasz je przez internet. Zaznacz więcej niż jedno pole, jeśli oferujesz kilka modeli.

Podstawa prawna: CIR 2024/2690 §5.2(b) · ISO/IEC 27001:2022 A.5.19, A.5.22, A.5.23

Dostarczasz oprogramowanie, które klienci instalują i uruchamiają na własnej infrastrukturze.

Podstawa prawna: CIR 2024/2690 §5.2(b) · ISO/IEC 27001:2022 A.5.19, A.5.22

Obsługujesz dla klienta części jego infrastruktury IT, własnym personelem. Typowe dla modeli MSP i MSSP.

Podstawa prawna: CIR 2024/2690 §5.2(b) · ISO/IEC 27001:2022 A.5.19, A.5.22

Tick yes if you hold or handle your customers' data or documents, electronically or on paper, for example in software, a data centre, a ticket system, accounting or an archive.

Podstawa prawna: ENISA TIG §5.1.2 · ISO/IEC 27001:2022 A.5.19

Tylko jeśli: We process or store our customers' data = Tak

Wszystkie kraje, w których przechowywane lub przetwarzane są dane Twoich klientów. Oddzielone przecinkami, kody krajów ISO. Przykład: DE, NL, US. Jeśli przetwarzasz dane wyłącznie w UE, wystarczy wymienić kraje UE.

Podstawa prawna: ENISA TIG §5.1.4 TIPS · ISO/IEC 27001:2022 A.5.20, A.5.23, A.5.34

Tick yes if you can sign in to your customers' systems, remotely, as an administrator or on site, for example for maintenance, support or operations.

Podstawa prawna: ENISA TIG §5.1.2 · ISO/IEC 27001:2022 A.5.19

Tick yes if your staff or subcontractors go into a customer's offices or buildings, escorted or not, for example for cleaning, maintenance, repairs, deliveries into the building or on-site support. Holding keys, badges or door codes counts.

Podstawa prawna: CIR 2024/2690 §11.1.2(a); §13.3.2(b) · ISO/IEC 27001:2022 A.5.19

Tick yes if everyone who works for customers learns the security rules that apply to them when they start, and again at regular intervals, for example in a short briefing, an e-learning course or written rules they sign.

Podstawa prawna: CIR 2024/2690 §5.1.4(b) · ISO/IEC 27001:2022 A.6.3

Tick yes if you either let customers audit you or give them audit reports instead (for example SOC 2, ISAE 3402).

Podstawa prawna: CIR 2024/2690 §5.1.4(e) · ISO/IEC 27001:2022 A.5.20, A.5.22

Tick yes if other companies help you deliver your service and in doing so reach customer data, systems or premises. Examples: a cloud host such as AWS or Azure, a payment provider, or a subcontracted crew that works on site.

Podstawa prawna: CIR 2024/2690 §5.1.4(g) · ISO/IEC 27001:2022 A.5.20, A.5.21

Tylko jeśli: We use subcontractors to deliver our service = Tak

Every subcontractor with name, location and what they do for you. One per line is enough. Update it whenever you add or remove one.

Podstawa prawna: CIR 2024/2690 §5.1.4(g) · ISO/IEC 27001:2022 A.5.20, A.5.21

Tylko jeśli: We use subcontractors to deliver our service = Tak

Tick yes if your contracts with subcontractors contain security requirements that match what your customers ask of you, for example on incidents, access and data handling.

Podstawa prawna: CIR 2024/2690 §5.1.4(g) · ISO/IEC 27001:2022 A.5.20, A.5.21

Tick yes if you tell customers before anything material changes in how you deliver: a takeover, a new subcontractor, another hosting provider, or a new country where their data is processed.

Podstawa prawna: ENISA TIG §5.1.4 · ISO/IEC 27001:2022 A.5.22

Tick yes if, when a customer asks, you say openly whether and which security incidents affecting customers you had in the past.

Podstawa prawna: ENISA TIG §5.1.2 · ISO/IEC 27001:2022 A.5.22

Tick yes if you give your customers the information their supervisory authority asks for after an incident or during an audit. Unless you are an essential or important entity under NIS 2 yourself, you owe that authority nothing directly; the duty is your customer's, and you help them meet it.

Podstawa prawna: ENISA TIG §5.1.4 · ISO/IEC 27001:2022 A.5.20, A.5.31

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Our staff enter our customers' premises = Tak

Tick yes if everyone who works for customers has signed a confidentiality commitment, in the employment contract or a separate agreement, or is bound by professional secrecy by law.

Podstawa prawna: ENISA TIG §5.1 TIPS; CIR 2024/2690 §10.3.2 · ISO/IEC 27001:2022 A.6.6

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Our staff enter our customers' premises = Tak

Tick yes if, before they start, you check that people who will have access to customer data, systems or premises (key holders, for example) are suitable for that role, as far as employment and data protection law allow: references, for example, or a criminal record certificate where lawful and needed for the role. Checking every member of staff is not expected.

Podstawa prawna: CIR 2024/2690 §10.2.1 · ISO/IEC 27001:2022 A.6.1

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Our staff enter our customers' premises = Tak

Tick yes if your contract commits you to hand back the customer's data in a usable, documented format (for example CSV or JSON) and then delete it, return keys, badges and documents, and close accounts you had with them.

Podstawa prawna: CIR 2024/2690 §5.1.4(h); §5.1.2(d) · ISO/IEC 27001:2022 A.5.11, A.8.10

Tylko jeśli: We process or store our customers' data = Tak

Needed when you process personal data on a customer's behalf and on their instructions (Art. 28(3) GDPR). Some professions are controllers by law and sign none, in Germany tax advisers (§ 11(2) StBerG).

• Yes, we offer a standard DPA
• Not needed: we are an independent controller (for example a tax adviser)
• Not needed: we process no personal data for customers
• No

Podstawa prawna: GDPR Art. 28(3); Art. 4(7) · ISO/IEC 27001:2022 A.5.34

Tylko jeśli: We process or store our customers' data = Tak

Tick yes if customer data is encrypted wherever you store it electronically: on servers, laptops, phones and backups, for example with BitLocker, FileVault or your cloud provider's disk encryption.

Podstawa prawna: CIR 2024/2690 §5.1.2(c); §9.2(a) · ISO/IEC 27001:2022 A.8.24

Tylko jeśli: We process or store our customers' data = Tak

Tick yes if your websites and interfaces use HTTPS with TLS 1.2 or higher, and files go to customers through an encrypted portal or encrypted email.

Podstawa prawna: CIR 2024/2690 §5.1.2(c); §9.2(a) · ISO/IEC 27001:2022 A.8.24

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak lub Świadczymy usługi zarządzane / MSP = Tak

Tick yes if you have a written information security policy with assigned roles, regular reviews and documented incident handling. ISO/IEC 27001 certification, also on the basis of IT-Grundschutz, implies yes.

Podstawa prawna: CIR 2024/2690 §5.1.2(a) · ISO/IEC 27001:2022 A.5.1

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak lub Świadczymy usługi zarządzane / MSP = Tak

Counts: ISO/IEC 27001 (also on the basis of IT-Grundschutz), a BSI C5 attestation, a TISAX label, a SOC 2 Type II or ISAE 3402 report, or a European cybersecurity certificate. Tick yes only if its scope covers the service you deliver to customers.

Podstawa prawna: CIR 2024/2690 §5.1.2(a); ENISA TIG §5.1.2 · ISO/IEC 27001:2022 A.5.19, A.5.22

Tylko jeśli: We hold a current security certificate or audit report that covers the service we deliver to customers = Tak

Copy the scope as it is printed on the certificate or report. Several? One per line.

Podstawa prawna: CIR 2024/2690 §5.1.2(a); ENISA TIG §5.1.2 · ISO/IEC 27001:2022 A.5.22

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak lub Świadczymy usługi zarządzane / MSP = Tak

Tick yes if you have a set routine for security holes in the systems and software you use for customers: you learn about them, judge how urgent they are, and install the update or take another measure in time.

Podstawa prawna: CIR 2024/2690 §5.1.4(f) · ISO/IEC 27001:2022 A.8.8

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak lub Świadczymy usługi zarządzane / MSP = Tak

Tick yes if a written plan sets out how you handle a security incident: who decides, who informs customers and who documents.

Podstawa prawna: CIR 2024/2690 §5.1.2(a); §3.1 · ISO/IEC 27001:2022 A.5.24, A.5.26

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak lub Świadczymy usługi zarządzane / MSP = Tak

Tick yes if a written plan says how you keep working or restart after an outage, including backups of the data you hold for customers, kept apart from the live systems and test-restored. It names your critical systems, the fallback, and how long an outage may last and how much data may be lost at most.

Podstawa prawna: CIR 2024/2690 §5.1.2(c); §4.1; §4.2 · ISO/IEC 27001:2022 A.5.29, A.5.30, A.8.13

Tylko jeśli: We process or store our customers' data = Tak lub We access our customers' systems = Tak lub Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak lub Świadczymy usługi zarządzane / MSP = Tak

Tick yes if every account with administrator rights in your own systems (email, cloud, servers, accounting) needs a second factor to sign in, such as an authenticator app or a security key. Codes by SMS count but are the weakest option.

Podstawa prawna: CIR 2024/2690 §5.1.2(a); §11.7 · ISO/IEC 27001:2022 A.8.5, A.8.2

Tylko jeśli: Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak lub Świadczymy usługi zarządzane / MSP = Tak

Tick yes if an independent party tests these systems for security holes, as often as your risk calls for. A penetration test and an external vulnerability scan both count.

Podstawa prawna: CIR 2024/2690 §5.1.2(a); §6.5 · ISO/IEC 27001:2022 A.8.29, A.8.8

Tylko jeśli: Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak

Tick yes if your development follows set rules, for example a review before every change goes live, dependencies kept up to date, tests, and a check for known vulnerabilities. Asked only of suppliers who run software as a service or ship software.

Podstawa prawna: CIR 2024/2690 §5.1.2(a) · ISO/IEC 27001:2022 A.8.25, A.8.28

Tylko jeśli: Świadczymy usługi SaaS / hostowane = Tak lub Dostarczamy oprogramowanie on-premise = Tak

Tick yes if your website says how to report a security hole and what you then do, for example in a security.txt file (RFC 9116). From 11 December 2027 the Cyber Resilience Act requires such a policy and a contact address from makers of software products.

Podstawa prawna: CIR 2024/2690 §5.1.4(f); CRA Annex I Part II(5), (6) · ISO/IEC 27001:2022 A.8.8, A.5.21

Tylko jeśli: We access our customers' systems = Tak

Tick yes if everyone who signs in to customer systems uses their own account with a second factor, including remote maintenance tools such as TeamViewer; nobody shares a login.

Podstawa prawna: CIR 2024/2690 §5.1.4(a); §11.3.2(a); §11.5.2(b) · ISO/IEC 27001:2022 A.8.2, A.8.5, A.5.16

Tylko jeśli: We access our customers' systems = Tak

Tick yes if it is recorded who accessed your customers' systems with administrator rights, and when, so it can be traced afterwards. Recording whole sessions is not expected.

Podstawa prawna: CIR 2024/2690 §5.1.4(a); §3.2.3(e) · ISO/IEC 27001:2022 A.8.15

Tylko jeśli: Our staff enter our customers' premises = Tak

Tick yes if you always know who holds which key, badge or code, take it back when someone leaves or changes job, and tell the customer without delay when one is lost.

Podstawa prawna: CIR 2024/2690 §5.1.4(a); §11.2.2(d); §13.3.2(b) · ISO/IEC 27001:2022 A.7.2, A.5.11, A.5.18

Tylko jeśli: Our staff enter our customers' premises = Tak

Tick yes if your staff have written rules for working at customers, for example: let no one in, leave screens, devices and documents alone, report anything unusual to the customer.

Podstawa prawna: ENISA TIG §5.1 TIPS; CIR 2024/2690 §8.1.1 · ISO/IEC 27001:2022 A.7.2, A.7.7, A.6.3

Tylko jeśli: Świadczymy usługi SaaS / hostowane = Tak

Tick yes if your application offers sign-in with a second factor (an authenticator app, a security key or a one-time code), at least for your customers' administrators. Your own internal admin accounts are a separate question under security practices.

Podstawa prawna: CIR 2024/2690 §5.1.2(c); §11.7 · ISO/IEC 27001:2022 A.8.5, A.5.23

Tylko jeśli: Świadczymy usługi SaaS / hostowane = Tak

The most hours your service may be unavailable before it is restored. Give a value you keep.

Podstawa prawna: ENISA TIG §5.1 TIPS · ISO/IEC 27001:2022 A.5.30, A.5.23

Tylko jeśli: Dostarczamy oprogramowanie on-premise = Tak

Month and year, or the rule you apply. From 11 December 2027 the Cyber Resilience Act requires manufacturers to state this date at the time of purchase.

Podstawa prawna: CIR 2024/2690 §6.1.2(b); CRA Art. 13(19) · ISO/IEC 27001:2022 A.5.21

Tylko jeśli: Dostarczamy oprogramowanie on-premise = Tak

Hours from a critical vulnerability becoming known to your fixed release. From 11 December 2027 the Cyber Resilience Act requires manufacturers to fix vulnerabilities without delay.

Podstawa prawna: CIR 2024/2690 §5.1.4(f); CRA Annex I Part II(2) · ISO/IEC 27001:2022 A.8.8

Tylko jeśli: Dostarczamy oprogramowanie on-premise = Tak

Tick yes if you give customers an SBOM for your releases (CycloneDX or SPDX). From 11 December 2027 the Cyber Resilience Act requires manufacturers to keep an SBOM in the technical documentation of products with digital elements; handing it to customers is up to you.

Podstawa prawna: CIR 2024/2690 §6.1.2(c); CRA Annex I Part II(1) · ISO/IEC 27001:2022 A.5.21

Tylko jeśli: Dostarczamy oprogramowanie on-premise = Tak

Tick yes if every release and update carries a signature your customers can check before installing, for example Sigstore, Authenticode or PGP.

Podstawa prawna: CIR 2024/2690 §6.6.1(c); CRA Annex I Part II(7) · ISO/IEC 27001:2022 A.5.21