Summary: NIS2 binds EU entities directly, but EU customers are asking their suppliers for security evidence too. The technical controls Turkish exporters should have ready.
The EU's NIS2 Directive (2022/2555) sets cybersecurity obligations for "essential" and "important" entities operating in member states. Member states had to transpose the directive into national law by October 17, 2024.
A company based in Turkey may not fall under NIS2 directly. But the directive requires entities to manage supply chain security, so EU customers are sending security questionnaires to suppliers and adding cybersecurity clauses to contracts.
What do EU customers ask?
The most common topics in these questionnaires match NIS2's risk-management measures. The list below summarises what to prepare so you can answer with evidence.
1. Multi-factor authentication
A policy and screenshot showing MFA is enforced for email, VPN and admin accounts. If you use Microsoft 365, a Conditional Access report is good evidence.
2. Backup and restore
A backup policy, at least one immutable or offline copy and the date of the last restore test.
3. Vulnerability management
Regular vulnerability scanning, patch timelines and records of how quickly critical vulnerabilities were closed.
4. Incident notification
Entities under NIS2 must send an early warning within 24 hours of a significant incident, a notification within 72 hours and a final report within one month. Your customer will expect quick information from you too; write down whom you will notify as a supplier, and how fast.
5. Access control and encryption
Who accesses customer data, how often permissions are reviewed, disk encryption on laptops (BitLocker) and encryption of data in transit.
6. Training and awareness
Records of security training and phishing tests given to staff.
7. Your own suppliers
You also have software and maintenance companies accessing your systems. You need to show how you control their access.
Keep the evidence in one folder and update it every quarter. When the next questionnaire arrives, the answers are ready; an ISO 27001 certificate shortens most questionnaires.
Let's prepare the evidence together
At Bilgi Teknoloji we set up MFA, backup, vulnerability scanning and endpoint security and report the evidence you can use in customer questionnaires.
Received a questionnaire from an EU customer?
Let's work out which evidence answers each question.
Request a call