The vendor portal shows full completion. Every supplier answered the security questionnaire. The dashboard presents the work as finished.
The form does not show which service matters to which operation, what evidence supports each answer or whether a national NIS2 rule applies to the reviewing entity.
Fact: the issue in 30 seconds
Direct answer. Article 21 of Directive (EU) 2022/2555 addresses cybersecurity risk-management measures, including supply-chain security. A vendor questionnaire can be one input to a related decision. It is not evidence of implementation by itself and cannot settle entity scope, national transposition, supplier criticality or adequacy.
The hidden variable is the service-specific evidence path behind the supplier’s assertion.
Why the questionnaire feels complete
Questionnaires standardize collection. They create comparable fields, response dates and escalation queues. They can expose missing answers and give procurement a repeatable request.
The problem begins when collection becomes conclusion. A “yes” may refer to a company policy, different product tier or intended control rather than the service the buyer uses. A “no” may reflect a different practice. Without scope and evidence, either answer can mislead.
PARAVEILUX inference. The form is useful when it starts a bounded review, not when completion is treated as proof of security.
What the source record supports
NIS2 is Directive (EU) 2022/2555. Article 21 addresses cybersecurity risk-management measures and expressly includes supply-chain security. ENISA material is guidance, not the Directive or a substitute for national law.
This draft does not determine whether an organization is in scope, what national law requires or which penalty or measure applies. Those are jurisdiction-specific questions for qualified review.
Action: put scope before the form
Record the entity, service and jurisdiction being examined. Link the exact national and EU sources under review. Mark transposition, sector and role questions Not assessed until qualified review resolves them.
Then describe the supplier service’s operational function. Which business process depends on it? Which data, access, availability or recovery assumption matters? Who can explain the deployment and evidence? A company name is too broad to describe the dependency.
Only then can the questionnaire answer be interpreted within the relevant service boundary.
From assertion to reviewable evidence
For each material question, preserve the exact question and defined terms; supplier answer, author and date; service, region and tier covered; supporting material; buyer-side reviewer and decision; exception or conflict; action owner; and change trigger.
A certificate, policy or screenshot has its own scope and date. Record what it supports rather than treating one artefact as universal assurance.
Signal: signals and counter-signals
Investigate when a company-wide answer is applied to every service; the buyer has not enabled the control described; supporting material has no date or scope; supplier criticality is inferred from spend; or an inaccessible document is treated as evidence that no measure exists.
Counter-signals include a service boundary, exact source, dated supplier position, buyer-side configuration facts, named reviewer, contrary evidence and event-based refresh. They strengthen review. They do not prove security or compliance.
The hidden variable
The hidden variable is the link between supplier representation and buyer implementation. A supplier may offer a control that the buyer has not enabled. The buyer may use a configuration outside the supplier’s assurance boundary.
The owner’s job is to make that interface visible, not to turn a returned form into a technical or legal verdict.
Limitations: what this does not prove
A completed questionnaire does not prove security, NIS2 compliance, supplier adequacy or legal scope. A missing document does not prove that no measure exists. ENISA guidance is not interchangeable with the Directive or national law.
Entity scope, national transposition, sector, evidence sufficiency, duties, penalties and notification questions remain Not assessed.
Owner Q&A
Should questionnaires be abandoned?
No. They can be useful collection tools when questions are service-specific and connected to evidence, ownership and follow-up.
What is the first criticality question?
Ask which operation depends on the service and what would change if it moved or failed. Validate the answer with the relevant owners.
How often should evidence be refreshed?
No universal cadence is stated. Use defined change, renewal and material-event triggers reviewed for the organization’s scope.
Next verification
Identify the country, entity, sector and service under review, then ask whether the supplier answer is connected to service-specific evidence. Current national implementation, scope and requirements should be checked before treating the EU framework as a reader-specific conclusion.
Sources and limitations
- Directive (EU) 2022/2555 — official EU source; Article 21 includes supply-chain security, while entity and national-law application remain Not assessed.
This is general risk education, not professional or certified advice. The source describes a bounded EU directive context; whether it applies or a comparable gap can arise for you depends on current national rules, entity, sector, service, role and evidence.