Your responsibility /IT and security
The questionnaire comes from the customer’s buyer and runs to forty questions.
The answers should match last time, and last time somebody else wrote them.
For the IT lead and whoever answers the questionnaires. Included at every level, from the smallest upwards.
Some of the areas that usually sit with you
- Information security 4 documents
- GDPR and personal data 4 documents
8 documents written for your company, each with its statute on it.
The requirements you meet rarely come from a regulator. They come from customers before a contract, and they get tighter every year because your customer was handed them by their customer.
Each questionnaire gets answered from scratch, because the last set of answers is sitting in somebody’s inbox. That costs half a day per questionnaire and produces different answers to the same question.
What you need is one place where the answer lives, with a date on it.
Four situations you meet
- Security questionnaire before a contract
- Information security policy, access routine, incident routine
- Someone leaves
- Access closed, and a documented routine for doing it
- You change system supplier
- New data processing agreement, updated record of processing
- You start using an AI tool
- An AI policy that agrees with the IT security policy
Examples of the documents you get
| INFORMATION SECURITY | STATUTE |
|---|---|
| Information security policy | GDPR Article 32 |
| Routine for access and permissions | GDPR Article 32 |
| Supplier requirements | Customer requirements and GDPR Article 28(3) |
| Material for security questionnaires | Customer requirements |
| GDPR AND PERSONAL DATA | STATUTE |
|---|---|
| Record of processing activities | GDPR Article 30 |
| Data processing agreement | GDPR Article 28(3) |
| Routine for a personal data breach | GDPR Articles 33 and 34 |
| Routine for retention and access | GDPR Article 32 |
NIS2 covers eighteen designated sectors. Outside those you are not caught by it, whatever your size. Your customers can still impose the requirements by contract.
Checked against GDPR Articles 28, 30 and 32 · Updated 10 October 2026
How it starts
The Health Check gives you a list of gaps for IT and security, area by area. You do not have to hand over any personal data to see it.
How it continues
The documents are written for your company and hold together with one another. Change one and you see what it means for the others.