Questionnaire to assess your suppliers’ security
Classify each supplier by its access, data and dependency. Ask for proportionate evidence and record your decision.
Free, no sign-up. Answer block by block, or send the questionnaire to the supplier, and get its risk level and the evidence you still need to request.
From register to review
Note the service and the contacts, answer seven questions to classify the supplier and review its questionnaire block by block. You can send it blank, in Excel or Word, or fill it in yourself. The level and the suggested decision are Minery criteria: they do not replace an audit or the decision of whoever signs the contract.
What the supplier declares and what you check against evidence do not carry the same weight. A Not applicable on a critical control stays pending until you accept its reason. Informational questions are not scored and, if none applies, the result is “No assessment”.
Your data stays in your browser
The tool works without third-party trackers. What you write stays on the page and is lost when you reload: save your assessment to a file to carry on another day. You can also download the register in Excel, send a blank questionnaire and print the report. When you open a saved file you will need to confirm the reviewed evidence and the critical Not applicable answers again.
If you or your customer is a financial entity, the tool adds the DORA questions and fields for due diligence, concentration and conflicts of interest. The download is not the DORA register of information. References to rules point to related topics, not that you comply with them.
What to do with a pending answer
Start with the critical controls. If an answer is missing, the supplier says No or a critical Not applicable has not been accepted, the result asks for measures before acceptance. Ask for a specific clarification and the evidence listed in each control. Writing a document reference is not the same as having reviewed it: switching to reviewed evidence is for the assessor.
Then review the partial controls and the statements without evidence. The pending items download brings together what is still to be resolved, with the evidence worth requesting. You can record an improvement plan, but it will only show as agreed when you state that it exists, its date and its owner. Keep the decision suggested by the calculation separate from the decision you make about the contract.
A directory you can act on
The register includes ICT products, services and processes, as well as functional security and incident contacts. Add an identified alternative and record the incidents reviewed, the unscheduled reviews and the changes with their measures. This structure takes as its reference the supply chain directory and monitoring in Commission Implementing Regulation (EU) 2024/2690. Using it does not determine that this regulation applies to you, nor does it prove on its own that you comply with it.
Frequently asked questions about supplier assessment
For security, this tool classifies each supplier with seven criteria: access to your systems, data processed, effect of a disruption, ability to replace it, integration of its product into your deliverables, subcontracting and protected functions. The highest-impact situation decides. Criteria such as quality, price or delivery time are outside this tool.
Note the service and the contacts, answer seven questions to classify the supplier and review its questionnaire block by block: you can send it blank, in Excel or Word, or fill it in yourself. Then ask for evidence of what is pending, record your decision and set the next review.
The question set’s design links its controls to NIS2 supply chain security. That does not determine whether your entity falls within its scope or which national regime applies to it. Confirm the status of transposition in your country (in Spain, the Spanish transposition) and your scope before making a legal decision. The tool helps you organise an assessment; it does not give an opinion on applicability.
The level depends on seven answers about access to systems, data processed, the effect of an interruption, how easily it can be replaced, whether its product is part of what you deliver, subcontracting and protected functions. The situation with the greatest impact decides. You can adjust the level by one step with a written reason, but lowering it does not remove the critical controls that follow from the recorded answers. It is a Minery classification, not a legal category.
Do not replace a review of the service with the name of a certification. Ask for its scope and check which entity, services and activities it covers. The question set distinguishes a certification from a report and lets you record a reference to the evidence you have examined. Its mappings show thematic relationships with controls: they are not a statement of conformity or a reproduction of the ISO text.
Start from the specific service, the data and the access the supplier will have. Use the pending controls to prepare points on incidents, subcontracting, continuity and exit. A positive answer does not prove that those commitments are in the contract. Contract wording needs a review for your case; this page does not offer a universal clause or replace that review.
The tool adds specific questions when you or your customer is a financial entity. It also lets you record whether the service supports a critical or important function, the due diligence, the concentration assessment and conflicts of interest. Those fields belong to the assessor and are not filled in by importing a questionnaire. The resulting Excel file is not the DORA register of information and does not replace its official templates.
The question set’s ENS references help you find topics to review in the service and its evidence. They do not turn an answer or a score into an ENS certification. The scope of the system and the requirements that apply need checking separately.
In the memory of the tool page, while you keep it open. You can save it to a file on your device. It is not saved automatically when you leave: save a copy before reloading. When you load it again, evidence is no longer marked as reviewed and acceptances of critical Not applicable answers are removed so that you check them again. Protect the copies according to how sensitive their content is.
As a follow-up criterion, the tool suggests twelve months for level three, twenty-four for level two and renewal for level one. These are Minery guidelines, not universal legal deadlines. Also review after a supplier incident, a significant change to the service or an unscheduled review. Record the reason, the measures and the next date so that the assessment has continuity.