Before the Purchase Order: Cyber Evidence UK Vendors Need for New European Contracts

A UK software vendor with no establishment in the European Union can spend months assuming that the bloc's second Network and Information Security Directive has nothing to do with it, then lose a Romanian contract at the procurement stage to a questionnaire that quotes the directive back at it. The pattern is now familiar. A buyer's security team issues a supplier assessment running to forty or sixty questions, asks for supporting artefacts, and treats an incomplete return as a scored weakness rather than an administrative delay.

The directive is not, in most cases, the legal source of the obligation. The obligation is contractual. That distinction matters, because it determines what a UK firm should prepare, what it should refuse, and what it should price.

Why a British supplier meets a rule that does not bind it

NIS2 applies to entities providing services in the EU that fall within its sectors and size thresholds, and member states transposed it into national law during 2024 and 2025. Romania's transposition brought essential and important entities under the supervision of the national cyber-security authority, with registration and incident-reporting duties attached.

None of that directly regulates a company incorporated in Manchester and operating from Manchester. What it does regulate is the buyer. Risk-management duties under the directive explicitly extend to supply-chain security, which means a Romanian energy distributor, hospital group or logistics operator under supervision has a regulatory reason to interrogate its suppliers — including those outside the EU. Add public procurement, where evaluation grids increasingly carry a cyber-governance line, and EU-financed programmes in the Western Balkans, where lenders and implementing agencies attach their own security annexes, and the questionnaire becomes a market condition rather than a legal one.

Treat it as a market condition and it stops being mysterious. You are not defending yourself against a regulator. You are answering a customer who must be able to show its own supervisor, or its own lender, that the chain behind it is governed.

What the questions are actually testing

Most supplier assessments cluster around a small number of concerns, however many pages they occupy.

• Accountability. Who in the organisation owns security, and can that person be named? A board-level owner, a named security lead and a documented reporting line answer more questions than any product brochure.
• Inventory and risk. Do you know what you hold, where it sits and what would happen if it were lost? An asset register and a repeatable risk-assessment method are the evidence.
• Incident handling. Can you detect, contain and notify? Buyers increasingly mirror statutory timelines — an early warning within twenty-four hours, a fuller notification within seventy-two — in their contracts, whether or not the directive binds you.
• Access and change control. Multi-factor authentication, privileged access management, joiner-mover-leaver processes, patch cadence and vulnerability remediation targets.
• Continuity. Backups, tested restoration, and a business continuity plan that has been exercised rather than merely written.
• Supply chain of your own. A sub-processor list, and evidence that you impose comparable terms downstream.

Notice that only the last item is about suppliers. The rest is about whether your organisation can describe itself in a way an auditor would recognise. Certification helps — ISO/IEC 27001 remains the most widely accepted single artefact in continental procurement, and SOC 2 Type II reports are read with increasing fluency — but a current certificate does not substitute for answers. Buyers have learned that a certified supplier can still fail to describe its own incident process.

For smaller UK firms, Cyber Essentials Plus provides a defensible baseline for technical controls, though it is less recognised in Bucharest than in Bristol. Present it as an entry point and pair it with a written governance narrative.

Build the pack once, reuse it many times

Companies that answer these questionnaires well stop treating each one as a fresh exercise. They maintain a controlled folder — versioned, dated, owned by a named individual — that maps to the common question set.

A practical pack contains: the security policy set at one-page summary level; an architecture or data-flow diagram for the service in question; the asset and data inventory extract relevant to that customer; the risk-assessment methodology; incident response plan and the last post-incident review; continuity and backup test records; access control standards; patch and vulnerability management SLAs; security awareness training completion rates; penetration test summary letter with remediation status; sub-processor register; data residency statement; insurance details; and the named security contact with escalation route.

Two disciplines make the pack work. First, keep every artefact dated and no more than twelve months old, because stale evidence reads as inattention. Second, separate what is true of the whole company from what is true of the specific service being sold — buyers penalise vagueness, and a generic corporate answer to a service-specific question invites a follow-up that costs a week.

The clauses that decide whether the evidence holds

A questionnaire is the opening position. The security schedule is where the exposure is fixed, and it is frequently signed by commercial staff who never saw the assessment return.

Three points deserve negotiation. Define the notification trigger precisely: does "incident" mean any security event, or a confirmed breach of confidentiality, integrity or availability affecting customer data? An undefined trigger combined with a twenty-four-hour clock is unworkable. Scope the audit right: remote evidence-based review on reasonable notice, capped in frequency and cost, is different from an unlimited on-site right. And check the flow-down obligation — if you must impose "equivalent" terms on sub-processors, confirm your own contracts permit it before you sign.

It is also worth confirming that representations made in the questionnaire are not silently incorporated as warranties. A statement that a control is "planned for Q3" becomes expensive if it is annexed to a contract without qualification.

Where the pressure is strongest

Romanian buyers in supervised sectors are the most systematic questioners, partly because registration and reporting duties have concentrated attention on supply chains. EU-financed work in Serbia, Albania, Moldova and Bosnia and Herzegovina adds a second layer: implementing agencies and lenders attach security requirements to grant and loan conditions, and those flow through the prime contractor to every subcontractor regardless of the directive's territorial reach.

Firms bidding in consortium should establish early which party carries the security schedule and whether evidence will be pooled. A subcontractor that assumes the lead contractor's certificate covers it is usually disappointed.

A realistic timetable

Assembling a credible pack from nothing takes six to ten weeks, most of it spent retrieving evidence that exists but is scattered across IT, HR and legal. Negotiating a security schedule takes a further two to three rounds with a determined buyer.

Start before the tender, not after the shortlist. The firms that lose these contracts rarely fail on technical merit. They fail because they answered a governance question with a product feature, and the buyer noticed.