SaaSFort A procurement analyst at your largest enterprise customer forwards an email: “Our NIS2 supply-chain reviewer would like 45 minutes with your security owner next Thursday.” No questionnaire this time. A live call. Camera on. Someone whose job is to decide whether your company stays an approved vendor under their NIS2 Article 21(2)(d) obligations.
This call is now routine. German enterprises in NIS2 scope are pushing audit pressure down their supply chain — and SaaS vendors are the supply chain. The vendors who lose the account aren’t the ones with weak security. They’re the ones who can’t prove it in 45 minutes, on screen, without scrambling.
Here’s how the call actually runs, and how to win it.
What the Auditor Is Actually Checking
The reviewer is not running a pentest. They have a narrow mandate: confirm that you, as a supplier, don’t introduce unmanaged risk into their NIS2 compliance. That mandate maps to three questions, every time.
- Do you have a defined security posture, and can you show it today? Not last quarter’s PDF — today’s state.
- Is it monitored, or was it a one-off? A single 2024 pentest doesn’t answer this.
- Can the customer verify your claims independently? Auditors trust evidence they can re-check without you in the room.
Everything below serves those three questions. If your answers don’t, the reviewer writes “insufficient assurance” and your account owner gets a remediation deadline.
The 45 Minutes, Minute by Minute
Minutes 0–10: Posture summary
The reviewer opens with “Walk me through your external security posture.” This is where most vendors lose the room — they pull up an architecture diagram and start narrating.
Don’t. Open with a single grade and a date. “Our external posture is graded A as of this morning — here’s the live report.” A transparent A–F grade with a timestamp answers question one in eight seconds and sets the tone: you measure this, you don’t guess.
If you walk in with a 90-page pentest instead, expect the same outcome covered in security grade vs pentest report: the auditor skims the executive summary and asks for the grade anyway.
Minutes 10–25: Control mapping
Now the reviewer drills into NIS2 Article 21(2) measures. Expect direct hits on:
- (b) incident handling — “How fast would you tell us if you were breached?”
- (d) supply chain security — “What about your subprocessors?”
- (e) secure acquisition and configuration — TLS, headers, exposed admin surfaces.
- (g) cyber hygiene — patch cadence, certificate management.
Answer each with evidence, not intent. “We enforce HSTS, our TLS chain is complete, and no admin panel is publicly reachable — visible on the report, line by line.” Vague answers (“we take security seriously”) read as a red flag to a trained reviewer. Specific, checkable answers read as a managed program.
This is also where preparation shows. Vendors who have already run their own NIS2 audit evidence inventory answer in seconds. Vendors who haven’t go quiet and promise to “follow up by email” — which the reviewer logs as a gap.
Minutes 25–40: Independent verification
The decisive moment. The reviewer says: “Can I confirm any of this myself?”
The wrong answer is “we’ll send you our SOC 2 under NDA in two weeks.” That’s not verification — that’s a delay the auditor has to escalate. The right answer is a public, self-serve proof point the reviewer can open in their own browser while you’re still on the call.
Point them to your public trust page. A live security grade, control mappings, and a timestamp the customer can re-check next quarter without contacting you turns “trust us” into “check us.” Auditors approve vendors they can re-verify unattended — it removes them from the risk register.
Minutes 40–45: Follow-ups and the verdict
The reviewer summarizes gaps and asks for closure dates. If the first 40 minutes went well, this is short. The verdict isn’t usually delivered live, but the tone is: a reviewer who got checkable answers closes with “this was straightforward.” A reviewer who got intentions closes with “send me documentation and we’ll reconvene.”
How to Prepare in One Afternoon
You don’t need a GRC platform or a six-week project. You need three things ready before the call:
| Need | What it answers | How to get it |
|---|---|---|
| A current, dated grade | ”What’s your posture today?” | Run an external scan on your production domain — 60 seconds, A–F grade |
| Control-mapped evidence | ”Which Article 21 measures?” | Use the scan’s NIS2 mapping; pre-read the evidence guide |
| An independently verifiable page | ”Can I check this myself?” | Publish a public trust page the auditor opens live |
The vendors who treat the audit call as a sales call — controlled narrative, checkable proof, no scrambling — keep the account. The ones who treat it as a fire drill don’t.
FAQ
Is a NIS2 vendor audit call mandatory for SaaS suppliers? Not directly. NIS2 obligates the in-scope enterprise to manage supply-chain risk under Article 21(2)(d). They discharge that obligation by auditing suppliers — so the requirement reaches you contractually, through your customer, not through the regulator.
We have SOC 2. Isn’t that enough for the call? SOC 2 helps but doesn’t answer “what’s your posture today?” or “can I verify it myself right now?” Auditors increasingly want a live, dated, independently checkable signal alongside the annual report. The two are complementary — see security grade vs pentest report.
What if the auditor finds a gap on the call? A specific, dated gap with a closure commitment is a manageable outcome. The unrecoverable outcome is “no evidence available” — that’s what moves you off the approved-vendor list. Walk in with a current grade and most gaps are already closed or known.
How often do these calls recur? Typically annually, sometimes per major contract renewal. A public, self-updating trust page reduces repeat calls because the customer can re-verify without scheduling you — which is exactly why auditors like it.
Want to know the grade an auditor would see before they do? Run a free external scan on your production domain, then publish your trust page so the next vendor review is a five-minute confirmation instead of a fire drill.
Von der Theorie zur Praxis
Scannen Sie Ihre Domain kostenlos. Erste Ergebnisse in unter 10 Sekunden — ohne Registrierung.