Tackling NIS2 and CSRD at the same time as a supplier

You receive two kinds of questionnaires from your large customers. The sustainability department sends a CSRD questionnaire about emissions and waste. The IT department sends a NIS2 questionnaire about cybersecurity. Both concern the same customer, both have to be answered this year.

What overlaps

Both regulations ask for policies and procedures, not just figures. CSRD B7 (code of conduct, grievance mechanism) partly overlaps with NIS2 CY7 (acceptable use policy). Handling one well helps with the other.

What does not overlap

NIS2 asks for technical cybersecurity measures that CSRD does not cover. CSRD asks for quantitative environmental emissions that NIS2 does not cover. Treat them as complementary, not as duplicates.

How verified.supply manages both modules

Your VS profile covers the CSRD data points. Your NIS2 assessment covers the cybersecurity data points. A customer who wants both sends a single request. You approve and they receive all the data in one export.