What the self-disclosure covers
The self-disclosure collects master data, contacts and principles. The security questionnaire goes deeper. Send the long questionnaire only to suppliers with higher risk.
| Part | Content |
|---|---|
| Master data | Name, legal form, address, company register number, VAT number, LEI if available |
| Contacts | Sales, accounting, information security, data protection and an emergency contact |
| Service and locations | What the supplier delivers, from where, and where your data is processed |
| Certificates | Such as ISO 9001, ISO/IEC 27001 or ISO 14001, each with scope and expiry date |
| Subcontractors | Who contributes to the service, with service and country |
| Principles | Code of conduct, human rights and environment |
| Insurance | Liability insurance, for IT services also cyber insurance |
The information security questionnaire
Align the questions with recognised topics. In Austria, the ten minimum topics of § 32 (4) NISG 2026 fit well. ISO/IEC 27001:2022 covers supplier relationships in controls 5.19 to 5.23 of its Annex A.
| Question | Good answer | Evidence |
|---|---|---|
| Is a second factor required for remote access? | Yes, for all accounts with remote access | Extract from the policy |
| How quickly do you report incidents that affect us? | Within 24 hours | Contract clause or process description |
| Is there a valid ISO/IEC 27001 certificate? | Yes, with a suitable scope | Certificate with expiry date |
| Are backups stored separately and tested? | Yes, tested at least yearly | Record of the last test |
| Where is our data processed? | In the EU or on a suitable legal basis | List of locations and subcontractors |
Checking answers
- Plausible? Does the answer fit the size and industry of the supplier?
- Backed by evidence? Does the certificate cover the location and service you buy?
- Consistent with the outside view? The public setup, such as email protection, sometimes contradicts the answers.
- Current? Note the expiry date of every piece of evidence.
Ask only for personal data you really need. For contacts, a role and a shared address are often enough.
Template: content of a supplier self-disclosure
Copy these points into your form.
- Company name, legal form and address.
- Company register number, VAT number, LEI if available.
- Contacts for sales, accounting, information security, data protection and emergencies.
- Description of the service and locations.
- Place of data processing and subcontractors with country.
- Certificates with scope and expiry date.
- Reporting channel and deadline for security incidents.
- Code of conduct and principles on human rights and environment.
- Insurance with amount of cover.
- Date, name and role of the person giving the information.
You may copy and adapt this list freely.
Frequently asked questions
Is a supplier self-disclosure mandatory?
The NISG 2026 prescribes no specific form. It does require entities to consider the cybersecurity practices of suppliers (§ 32 (4)(d)). A self-disclosure is a common way to do that.
How often should it be renewed?
Every year for critical suppliers, otherwise every two to three years. Also after major changes such as a new owner or location.
Sources
- NISG 2026, § 32 (4), BGBl. I Nr. 94/2025
- ISO/IEC 27001:2022, Annex A, controls 5.19 to 5.23, Information security in supplier relationships
Legal sources checked on 31 October 2026. Legal information, not legal advice. For your own case, please ask a professional. The German version is binding.