← All templates
NIS2
EU Network and Information Security Directive 2. Covers cybersecurity risk management for essential and important entities.
20 questions·Version 2022
Risk Management
- Do you have documented cybersecurity risk management measures?Art.21(a)
- Is your risk management approach approved by senior management?Art.20
- Do you conduct regular cybersecurity risk assessments?Art.21(a)
Incident Handling
- Do you have a documented incident handling policy?Art.21(b)
- Can you report significant incidents to authorities within 24 hours of discovery?Art.23
- Do you have an incident response team or designated contacts?Art.21(b)
Business Continuity
- Do you have a business continuity plan covering cyber incidents?Art.21(c)
- Do you have documented disaster recovery procedures?Art.21(c)
- Is the business continuity plan tested at least annually?Art.21(c)
Supply Chain Security
- Do you assess cybersecurity risks in your supply chain?Art.21(d)
- Do you have security requirements for your suppliers and service providers?Art.21(d)
- Do you monitor your suppliers for cybersecurity incidents?Art.21(d)
Network Security
- Do you have network security controls and monitoring in place?Art.21(e)
- Do you use encryption for sensitive communications?Art.21(h)
Access Control
- Do you enforce multi-factor authentication for critical systems?Art.21(j)
- Do you have privileged access management controls?Art.21(j)
Vulnerability Management
- Do you have a vulnerability disclosure policy?Art.21(e)
- Do you conduct regular penetration testing?Art.21(e)
Training
- Do you provide cybersecurity training to all staff?Art.20
- Does senior management receive specific cybersecurity training?Art.20
Send this questionnaire to your vendors
VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.