ISO 27001Often required
The proof most customers know and accept. A certificate from an accredited body answers many questions from questionnaires and audits in advance. It is valid for three years, with annual surveillance audits.
View framework →Tailored solutions for B2B companies
Your customers assess their suppliers.
You are one of them.
If you supply large companies, you are reviewed regularly: with questionnaires, customer audits and requirements in the contract. NIS2 and DORA oblige your customers to assess their supply chain. Sightadel keeps your answers and evidence in one place, so every review builds on the same status.
Starting point
Where companies like yours stand.
For suppliers and service providers, security at the customer is part of the job. You have access to your customers' systems, data or production processes. An incident on your side can cause damage there. That is why large customers want to know how you work, before and during the cooperation.
The requirements come in many forms. A questionnaire with a hundred questions, an on-site supplier audit, a security annex to the framework agreement, a request for a certificate. Since NIS2 and DORA have applied, many customers are legally required to manage the security of their supply chain. They pass this obligation on to you through contracts.
The questions are similar, the forms are not. Answering each questionnaire separately keeps sales, IT and management busy with the same topics again and again. With an ISMS under ISO 27001, the answers are checked and backed by evidence once, and a certificate answers many questions in advance.
Why now
Typical reasons to tackle the topic.
01
A customer announces a supplier audit
The date is set and the auditor arrives with a list. The questions cover policies, access, the emergency plan and incident handling, each with evidence.
02
Questionnaires tie up your team
Every customer sends their own form, often in Excel and with a deadline. The answers are spread across several people and sometimes contradict each other.
03
Your customer falls under NIS2
Under section 30 BSIG, supply chain security is part of the risk management of important and essential entities. Your customers therefore have to assess you and bind you by contract.
04
Your customer is a bank or insurer
DORA requires financial entities to register and assess their ICT third-party service providers and to conclude contracts with fixed minimum content. As a service provider, you notice this in questionnaires and contract annexes.
05
Tender with a certificate requirement
Public and large private clients often make ISO 27001 a condition. Without a certificate, you do not make the shortlist.
06
Reviewing your own suppliers
What your customer requires from you often has to be passed on to your own subcontractors. This chain needs evidence too.
Relevant frameworks
What applies – and what it specifically requires here.
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
NIS2Depends on the situation
Directly affected if your sector is listed in the BSIG and you reach the size thresholds. Indirectly affected almost always, as soon as customers are covered and have to manage supply chain security under section 30 BSIG.
View framework →GDPRMandatory
If you process personal data on behalf of your customers, you are a processor. That requires contracts under Art. 28 GDPR, documented measures and a reporting chain for data breaches.
View framework →DORADepends on the situation
Applies to financial entities. If you provide ICT services to banks or insurers, you receive the requirements through contracts, questionnaires and audit rights. You usually provide the proof through your ISMS.
View framework →ISO 9001Recommended
Required in many supply relationships anyway. You run document control, internal audit and management review together with ISO 27001.
View framework →Recommended order
Where to start – and what comes next.
- 1
Collect customer requirements
Which customers require what? Questionnaires, contract annexes and audit reports from recent years show which topics keep coming back and which proof has the most effect.
- 2
Create a shared foundation
An ISMS under ISO 27001 covers the largest part. Customer-specific requirements that go further are mapped as a custom framework, and you link existing evidence.
- 3
Check the answers once
Where is the data, who has access, how is it backed up, how are incidents reported? Each answer gets dated evidence and a responsible person.
- 4
Prepare for audits
Customer audits and the certification audit draw on the same documents. Auditors get their own role in Sightadel and can never delete anything.
- 5
Show your status in the Trust Center
Certificates, approved policies, measures and subcontractors are on a dedicated page. You answer new questionnaires with a link and the few individual questions.
Focus
From questionnaire to evidenced answer
Supplier questionnaires will not go away. These steps help you answer them faster and consistently.
Spot recurring questions
Most questions cover the same topics: access, encryption, backups, emergency plan, training and subcontractors. The answers are in the ISMS and apply to all customers.
Customer catalogues as a custom framework
You import recurring catalogues from large customers from Excel or Word. Each requirement becomes a checkpoint, and you link existing evidence instead of searching again.
Public what may be public
In the Trust Center, you show certificates, summaries of policies and subcontractors. Confidential material such as audit reports or network diagrams is only released on request.
Your own supply chain in view
What customers require from you, you check with your own service providers. The vendor module manages them with risk, contract and evidence including validity dates.
How Sightadel helps
The features that make the difference here.
Custom frameworks
You create customer-specific requirement catalogues and security annexes as a custom framework, including by import from Excel or Word. You work with them like with any other framework.
Learn more →Trust Center
A dedicated page with certificates, approved documents, security measures and subcontractors. Your customers' purchasing teams find the answers themselves.
Learn more →Guided assessments
ISO 27001 and NIS2 are worked through control by control. Where requirements overlap with customer catalogues, one piece of evidence counts for all of them.
Learn more →Evidence archive
Evidence carries a date, version and expiry date. If a customer asks for evidence in an audit, you find it in the same place as for the certification audit.
Learn more →Vendor risk
Your own subcontractors are listed with criticality, questionnaire and evidence. Expired certificates stand out before the customer asks about them.
Learn more →Security Score
Sightadel checks the attack surface of your domains that is visible from the outside. Many customers assess suppliers from exactly this view.
Learn more →By arrangement
When a customer catalogue goes beyond the usual.
Some major customers send extensive security annexes or ask for reports in a specific form. You create custom frameworks yourself. If a catalogue is very extensive or you need a further integration, we implement it for you by arrangement.
Customisation
Suppliers and service providers with large customer catalogues or special requirements
- Customer catalogues prepared as a framework
- Reports in the form your customer requires
- Connecting a further system
Scope and costs are set out in a quote beforehand. Work only begins once you agree.
See customisationEffort and duration
An honest estimate.
- ISO 27001 to audit readiness4–8 months
- With a clearly defined scope, such as the services for your customers. With an existing ISO 9001 system, towards the lower end.
- Customer catalogue as a framework1–4 weeks
- Import, mapping to existing evidence and closing the gaps. The more an ISMS already covers, the shorter it takes.
- Preparing for a customer audit2–6 weeks
- With an existing ISMS, mainly reviewing evidence and open tasks. Without an ISMS, considerably longer.
The ranges are based on experience, not a commitment. The biggest factors are the number and scope of customer requirements and how much of it is already evidenced.
What you license · typically Professional
A typical supplier manages ISO 27001 and the GDPR in the Professional edition. It includes ten users, 25 vendors and three custom frameworks, enough for the catalogues of your most important customers. Licence for ISO 27001: from €750 per month. If ISO 27001 is included, the GDPR and, if needed, NIS2 cost permanently less. With many customer catalogues or companies in the group, Enterprise is the right fit.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Does an ISO 27001 certificate replace our customers' questionnaires?
Rarely in full. Many customers accept the certificate for a large share of their questions and want the rest answered, for example on locations, subcontractors or contract details. With a certificate and a Trust Center, usually only a few individual questions remain.
Our customer falls under NIS2. Do we as well?
Not automatically. Whether you are covered yourself depends on your sector and your size. Regardless of that, your customer has to assess their supply chain and passes requirements on to you through the contract. Clarify the classification of your case with your advisers.
How do we deal with Excel questionnaires?
You import recurring catalogues as a custom framework and link existing evidence. For one-off questionnaires, you use the checked answers from your ISMS and refer to the Trust Center.
Can a customer review us directly in Sightadel?
Auditors get their own role that can never delete anything. Whether you give a customer such access for an audit or release documents selectively is up to you.
What belongs in the Trust Center and what does not?
Certificates, summaries of policies, security measures and the list of subcontractors. Internal system names, network diagrams or complete audit reports do not belong on a public page. You release them on request.
Our customer requires an industry standard that Sightadel does not offer. What now?
First check the list of available frameworks. If the standard is missing, you map the requirements you have as a custom framework. Whether that is enough as proof for the customer is something you clarify with them or the responsible audit body.
Content reviewed by experts on 26 October 2026 · Not legal advice. The standard or law in its current version is authoritative.
Start with one standard.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.