Six in ten suppliers who know about NIS2 think the law applies to them in full, according to a flash survey by the Dutch Digital Trust Center. It does not. The Dutch implementation, the Cyberbeveiligingswet (Cbw), in force since 15 August 2026, places no obligations of its own on suppliers of in-scope organisations. The obligation is yours: you have to show that you know and manage the risks of your direct suppliers. What else the law requires is covered in NIS2 in practice. This article is about one part of it: the questions for your network and hosting provider, and which answers are worth anything.
A statement is not evidence
Most contracts from before NIS2 say the supplier takes "appropriate security measures". That is a promise, not evidence. According to Dutch consultancy Metri, the supervisor does not ask what the contract said, but what you did to verify it. And the audit rights that appear in every contract are rarely used in practice.
So ask for artefacts: something that exists independently of the questionnaire. A signed version of a policy document, a configuration history, an agreed notification window in the contract, a certificate with its scope. A "yes" in a spreadsheet cell with nothing behind it is a self-declaration, and you cannot show that to an auditor.
A second trap: the data centre's certificate is not your supplier's certificate. Plenty of hosting providers sit in a certified data centre. That tells you something about the building, the power and the access control, and nothing about who can reach your router.
The questions that matter
For a network or hosting provider, these questions carry the most weight:
- Notification window — how many hours until you hear about an incident that affects your service, and through which channel? You have to send an early warning within 24 hours yourself. A supplier who takes a day makes that impossible.
- Management access — how does the supplier reach the equipment: personal accounts or a shared login, over the public internet or through a separate management network, with which second factor?
- Configuration management — can you trace who changed what and when? Is a change tested, or rolled back if it goes wrong?
- Patch deadlines — how quickly are critical vulnerabilities in network and server equipment fixed?
- DDoS — what happens during an attack, who decides on blackholingBlackholing (RTBH) Dropping all traffic to one attacked IP address so the rest of your network stays reachable. The last resort during a DDoS attack., and what is and is not guaranteed?
- Backups and recovery — where are the backups, who can delete them, and when was the last restore?
- Certification — which certificate, with which scope, and what if there is none (yet)?
Ask proportionately. The supplier that can reach your systems gets this list; the one that delivers office supplies does not. There are also standardised questionnaires that a supplier fills in once and shares with every customer, such as the Dutch NIS2 Cyber Score from Samen Digitaal Veilig. That saves you reading and the supplier filling in.
What we answer
We get these questions too, and we have to be able to answer them to our own supervisor: we have been in scope as an essential entity ourselves since August 2026. In short:
- Notification window — we report an incident that affects your service within 8 to 12 hours. That leaves you room for your own report within 24 hours.
- Management access — our network equipment is managed from a separate management VRF that is only reachable through a VPN. Staff can only enter the admin part of our dashboard with a passkeyPasskey Signing in with a cryptographic key on your device instead of a password. Phishing-resistant, because the key only works on the real website..
- Configuration management — the configuration of our network equipment is in version control. We roll out changes with commit confirmed: if we lose the connection, the device reverts the change by itself.
- Patch deadlines — critical vulnerabilities within 7 days, high within 30 days. Those are upper limits; in practice it is faster.
- DDoS — basic protection comes with every IP transit connection. Mitigation often kicks in within seconds in practice, but that is not a guarantee. More in DDoS protection explained.
- Certification — our ISMS is set up according to ISO 27001; certification is in preparation. Our policy lives in git, and adopted versions carry a signed tag.
- Backups — we tell you where they are, and only quote recovery times once they have been tested and recorded.
We also say what we do not do. We have no SOCSOC Security Operations Centre: monitors systems for attacks and abuse and investigates security incidents. Not the same as a NOC. and we do not do penetration tests. For those we refer you to specialist firms.
Your supplier file
On our NIS2 page for customers we go through the questions an in-scope organisation asks an infrastructure supplier, with our answer to each and where the evidence is. If you buy IP transit, colocation or NOC-as-a-Service from us and there is a questionnaire on your desk: get in touch and we will fill it in with the documents attached.