CH
PL
What the law requires
The substantive duties fall into four blocks: risk management, business continuity including tested recovery procedures, supply chain security, and reporting and evidence obligations. Significant incidents follow a staged timeline: early warning within 24 hours, notification within 72 hours, final report within one month. Reports go to the competent CSIRT.
Three dates matter. The law applies from 1 October 2026. Registration with the Federal Office for Cybersecurity is due by 31 December 2026; the self-declaration on implemented risk management measures by 30 September 2027. Verification by independent parties becomes possible at the earliest from 1 October 2028. Organisations working to ISO 27001 already cover much of this – and that is why the supply chain so often remains the open flank: the management system is certified, the external parties' access is not.
The 10 questions
Access and permissions
1. Who on your team currently has access to our systems, and in what role?
You are not looking for a list of names but for a maintained, role-based overview available at short notice.
2. How quickly is access revoked when someone leaves the project?
What matters is not the target time but the trigger: is offboarding started automatically, or only when somebody notices?
3. Do your people use individual accounts in our environment, or shared ones?
Shared accounts are convenient and make traceability impossible.
Incidents and communication
4. How and within what time frame do you inform us about a security incident on your side?
Your own reporting clock starts when you become aware. This question belongs in the contract, not in the conversation.
5. Who is reachable on your side in an emergency, including outside business hours?
A named role with a deputy is robust. A general support address is not.
6. Have you had a reportable incident in the last 24 months, and what did you change as a result?
"No" is not automatically the better answer. What should raise an eyebrow is a provider with many clients who has never noticed anything.
Operations, data and recovery
7. Which of our data leaves our environment, and where does it go?
This includes test data, log files and ticket systems. The surprise is rarely the main system.
8. Do you use subcontractors for our service?
What matters is whether you are informed about a change before it happens.
9. When did you last test recovery, and how long did it take?
The interesting figure is the last one actually measured, not the contractual one.
10. What happens to our data and access when the engagement ends?
The exit question belongs at the beginning, while it is still negotiable.
How to read the answers
No provider will answer all ten flawlessly, and that is not the benchmark. What matters is the type of answer. Three patterns deserve attention: answers made entirely of certificates with no process described; answers that point to people rather than roles – which works until that person is on holiday; and answers that redirect the question towards your own responsibility without naming their own share.
Security is also a capacity question
The uncomfortable part is rarely the insight. It is the execution: maintaining permission models, testing recovery, updating contracts, documenting incidents. Those tasks take time – and in many IT teams time is the scarcest resource of all. If the questions are clear but the capacity to answer them is missing, that is not a compliance problem. It is a resourcing one.
Would you like the ten questions as a checklist for your partner conversations? Write to sales@suppliance.at, and we will send it over.
This article is editorial context, not legal advice. Whether your organisation qualifies as an essential or important entity, and which obligations apply, must be assessed case by case.