Compliance5 min read

How to answer your customer's security requirements without a big IAM project

When the questionnaire from your NIS2-covered customer arrives, there are two bad answers: promising more than you can deliver, and not answering at all. Here is the third way – a phased approach you can document as you go.

Article: answering NIS2 supplier requirements

The starting point

Answer honestly – but show a plan

A supplier questionnaire is not an exam you must pass with top marks from day one. The customer knows a supplier with 100 employees does not have the same setup as a large corporation. What the customer is really assessing is whether you understand your own situation and whether you are working to close the gaps.

An honest answer with a concrete plan therefore almost always beats a polished answer without substance. Conversely, "we have that under control" without documentation is an answer that collapses at the first audit – and trust is hard to rebuild after that.

The approach

Four phases – start small, expand at your own pace

Establish an overview
Map your systems and pull a list of who has access to what in the most important ones. That alone answers the customer's most frequent question – and usually reveals accounts that should have been closed long ago.
Make HR the master
Let the HR system be the source of truth for who is employed. Connect it to Active Directory and Entra ID so a departure in one place automatically revokes access everywhere – same day, with a log.
Automate on- and offboarding
Replace manual account creation and checklists with fixed, automated processes. That removes both errors and the documentation burden that otherwise consumes the hours before a supplier audit.
Document and verify
Introduce recurring reviews where system owners confirm that access rights are still justified. Save the results – that is exactly the documentation the customer's auditor asks for.

What about the systems that cannot be integrated?

Every company has systems that cannot be connected to central governance: legacy line-of-business systems, machine controls, cloud services without proper integrations. You do not need to replace them to answer your customer. The answer is regular manual review with documentation – not perfect automation everywhere.

The point of the phased approach is precisely that you start with the systems that matter most to the customer and the delivery, and expand from there. The first demonstrable results can typically be shown within weeks, not years – whether the solution is built on Pointsharp, Omada or Microsoft Entra ID Governance, depending on your system landscape and size.

Tools

Download the checklist and the whitepaper

We have collected the customer's typical questions and the answers an auditor accepts in a checklist you can use directly in your own response to a supplier questionnaire.

If you want to go deeper into the phased approach, our whitepaper describes the phases, the roles and the typical pitfalls – and what you can do yourself before involving a vendor or advisor.

Whitepaper

Access governance in 12 weeks: the phased approach, phase by phase.
Roles and responsibilities: who needs to be involved, and how much time it takes.
Get it here: iam-group-nis2-whitepaper-en.pdf below the article or via the link in the checklist.