NIS2 Supply Chain Questionnaire

An open data format. The questions a NIS2-regulated entity needs to ask its suppliers, expressed once as a typed Zod schema and published as JSON + JSON Schema.

It exists because every German Mittelstand procurement team is currently inventing its own supplier questionnaire from scratch and sending suppliers five slightly different versions of the same NIS2-anchored questions. This repo is one shared, openly maintained, legally-anchored questionnaire that any of them can adopt or fork.

Where this is developed

The source of truth for this package is the packages/nis2-supply-chain-questionnaire-schema/ directory of the open-isms monorepo, because that is the copy the supplier portal imports and therefore the copy that is actually exercised. This repository is a publication mirror, updated by running scripts/push-questionnaire-schema.sh in the monorepo.

Practical consequence: open issues and pull requests here, but expect the fix to land in the monorepo first and arrive here on the next publish.

What it isn't

Not an app, not a SaaS, not a UI. There is no backend, no auth, no database. Bring your own.

The reference implementation is the supplier portal at nisd2.eu, which uses this exact data format. You are free to build your own.

What's in it

• 59 fields across 6 sections (profile, security_practices, saas_technical, on_prem_technical, pro_services, managed_services)
• Each field anchored to an EU-level primary source: NIS2 Art. 21(2), CIR 2024/2690, ENISA Technical Implementation Guidance v1.0, GDPR Art. 28, or the Cyber Resilience Act
• Nine locales: English, German, French, Italian, Spanish, Polish, Czech, Portuguese and Romanian
• Published as a Zod schema (TypeScript), a JSON artefact, and a JSON Schema for non-TS consumers

What's deliberately out of scope

National-derivative frameworks (BSI IT-Grundschutz / Lieferketten-Checkliste in Germany, ANSSI in France, CCB CyberFundamentals in Belgium, etc.). The EU instruments above are the load-bearing legal substance and travel across all 27 member states. National overlays are downstream and belong in their own extension repos — keeping the core questionnaire EU-only avoids drift and keeps it usable everywhere.

How it's maintained

• Source of truth: TypeScript files in src/fields/<section>.ts. Edit these, never edit the JSON.
• Generated artefacts: data/supply-chain-questionnaire.json and schema/supply-chain-questionnaire.schema.json — regenerated by bun run build:json.
• Invariant tests: tests/invariants.test.ts — uniqueness, cross-references, citation provenance, helper-function behaviour.
• CI: typecheck, validate, tests, drift check on every push.

Install

This package is not on the npm registry — install directly from GitHub.

bun add github:NISD2/nis2-supply-chain-questionnaire-schema#v3.1.0
# npm, pnpm, yarn — same syntax

If you only need the data or the JSON Schema, download them directly from the repo. No build step.

Usage

import {
  supplierQuestionnaire,
  groupBySection,
} from "@nisd2/nis2-supply-chain-questionnaire-schema";

for (const [section, fields] of groupBySection(supplierQuestionnaire)) {
  console.log(`${section}: ${fields.length} fields`);
}

More examples — Drizzle storage, multi-page form rendering — under examples/.

Field shape

{
  id:            "mfaEnforcedInternal"       // stable camelCase key
  section:       "security_practices"
  type:          "boolean"                   // string | text | email | phone | url | country | boolean | enum | integer
  label:         { en, de }
  description:   { en, de }                  // why this field exists, with legal context
  legalBasis:    "NIS2 Art. 21(2)(j)"        // EU-level primary citation
  required:      true
  visibleWhen?:  { field: "isSaas", equals: true }   // gates section visibility
  options?:      [{ value, label: { en, de } }]      // type=enum only
}

Full Zod schema in src/schema.ts.

Not legal advice

Structured guidance based on our reading of the NIS2 Directive, CIR 2024/2690, and ENISA Technical Implementation Guidance. It does not constitute legal advice. Consult qualified counsel.

Companion repo

NISD2/nis2-gap-assessment-schema — same data-format approach for NIS2 self-assessment.

Contributing · Security · Changelog

CONTRIBUTING.md · SECURITY.md · CHANGELOG.md

Licence

Dual: MIT for code, CC BY 4.0 for content. See LICENSE.

Substantive issues / partnership questions: [email protected].