A customer sent a forty question NIS2 questionnaire

evan

A B2B customer sent a forty question security questionnaire, NIS2 all over it.

Six staff.

One question is about the AI Act, because of a chat widget.

Reads like their own audit, copied one level down.

Does any of it apply here, or is the customer just pushing its obligation down?

wildanchor

Just received it from one of our logistics clients, also in spring.

NIS2 did not apply directly.

The requirement came in by way of a supplier clause in the contract.

Andrew

A nice observation.

Indeed, being bound by NIS2 on the customer side comes down to their sector and their size. In turn, a supplier (such as ourselves) will typically be pulled in by contract.

So there are certainly commercial decisions at play. Namely, should we respond to this questionnaire and put the time and resources into it?

I think that is the crux here, surely: we have to make the call, for ourselves, on the importance of the business relationship over this one response.

A very straightforward call, perhaps. And no different from other supplier decisions.

Either way, thanks for raising the issue.

Turkan.Turgut

Andrew wrote
Either way, thanks for raising the issue.

I think that it does: applies to any organisation employing ten or more people with an annual turnover of at least two million.

Any thoughts?

Andrew

Not really. It simply means that the thresholds for size apply to the industries listed above such as transport, energy, health and digital infrastructure and therefore a 6 member web shop would not be found within the listed industries.

A company in one of those industries is only affected once it also passes the criteria of more than 10 members and turnover of 2 million...

So no, it would not affect a 6 member web shop

Turkan.Turgut

Oh I see - my vendor webinar didn't mention the industry list then

byteme

The one about AI Act is really to inform visitors it's a machine they're talking to. They'd need a UI element on the chat widget, and a para in the privacy notice.

An afternoon's work!

DossantosJournal

What do the forty questions ask for? Is certification e.g. ISO 27001 required? Or do I call them, take them for an hour and come back with "nothing relevant"?

evan

Things like the following! (Backup frequency & last restore test, who has admin access, MFA required?, incident contact available 24hr?, list of sub-contractors, and wher is customer data stored.

Two questions about ISO27001 equivalent measures, one of them specifically requesting a description).

anita.rath

in a similar way, we have just answered a similar questionnaire by simply drafting a 3 page description of what we do to meet the standard.

Then simply copying and pasting it as required. Was a piece of cake. And as yet, the customer has not insisted we now hold one of the certificates.

wildbadger

Is it worth the bother to get a consultant to do this?

anita.rath

Got a quote of 4,500 EUR for a readiness scan, wrote a first version in two evenings instead, got a couple of hours paid by an independent to read it

troygray88

And im drifting over to my own chat widget. I think it gets asked about delivery times, not much else, apart from the odd support query. And im not really sure why I want one at all.

Where I'd have to be really really explicit is the AI in the widget. I had not even thought about the AI Act until that one question showed up.

Not really sure of the best approach for the AI part at all, though I suppose we could avoid the question entirely.

And the client may well not know what AI in general is.

byteme

Back to what I said, A disclosure is quick and easy.

The questionnaire, on the other hand, has a deadline attached to your account.

evan

I submitted the questionnaire and answered four items N/A and gave a reason, they accepted without pressing me for more detail.

They just put a contact window to twenty four hours. As of last night that became part of the new contract, and they named a person with a phone number

wildanchor

We have identical "contact incident by telephone" clauses in two other customers' new contracts so i recommend putting your answers in one place they ask the same things in another order