The IT Ops vs IT Risk Misconception
Most software companies believe they take security seriously. They have an endpoint protection platform, a password manager, SSO with MFA, regular vulnerability scans, and a cloud provider with strong infrastructure security. That is a reasonable IT Operations posture.
It is not a security governance programme.
The distinction matters because NIS2 does not audit your tools — it audits your governance. When an enterprise customer sends a 200-question security questionnaire, they are not asking whether you have antivirus software. They are asking whether you have a documented risk management framework, a tested incident response procedure, a sub-processor register, and board-level accountability for information security.
Most SaaS companies cannot answer yes to more than two or three of those questions. That is the gap that blocks deals, fails audits, and creates liability exposure under NIS2's supply chain provisions.
| Security Domain | IT Ops (What Most SaaS Has) | IT Risk (What NIS2 Requires) |
|---|---|---|
| Access Control | ✕MFA, SSO, RBAC configuration | ✓Access policy, quarterly access reviews, privilege escalation process |
| Incident Response | ✕Helpdesk tickets, monitoring alerts, on-call rotation | ✓Incident classification matrix, NIS2 Art. 23 notification chain, post-incident review |
| Vendor Management | ✕Procurement approvals, contract sign-off | ✓Formal TPRM programme, criticality assessments, sub-processor register |
| Documentation | ✕Runbooks, technical wikis, architecture diagrams | ✓ISMS, information security policies, audit evidence package |
| Compliance | ✕GDPR privacy notices, cookie banners | ✓ISO 27001 / SOC 2 certification, continuous audit trail, regulatory change monitoring |
| Board Reporting | ✕IT dashboard shared with CTO | ✓Board-level risk reporting, personal liability awareness, strategic security decisions |
Why Supply Chain Is Now Your Problem — Even If You Are Not Directly In Scope
NIS2 applies directly to organisations that operate essential or important services in banking, financial infrastructure, health, digital infrastructure, and cloud services. If your SaaS company does not fall into one of these categories, you might assume NIS2 is someone else's concern.
That assumption is expensive.
Under NIS2 Art. 21(2)(d) and (e), regulated entities must implement supply chain security measures — including assessments of their ICT vendors' security posture. Under DORA Art. 28, financial entities must assess every third-party ICT provider against defined security criteria. Your customers' compliance obligations flow directly into their procurement and vendor management requirements — which flow directly to you.
You do not need to be in scope for NIS2 to be affected by it.
Every SaaS vendor that sells to a bank, insurer, hospital, energy company, or public authority is now subject to vendor security assessments that mirror NIS2 and DORA requirements. If your security governance does not meet the bar, you will not pass the assessment — regardless of how good your product is.
Three Ways NIS2 Affects You as a Vendor
Supply Chain Security (Art. 21)
NIS2 requires essential and important entities to assess the security practices of their direct suppliers and service providers. This creates a cascading obligation: your bank or hospital customer must assess you, and they must document that assessment. Your questionnaire response is now part of their regulatory evidence package — which means it will be examined in their supervisory review.
Incident Notification Impact (Art. 23)
If a security incident in your SaaS platform affects a NIS2-regulated customer, that customer must notify their competent authority within 24 hours. A breach notification process that does not account for this downstream effect — including tested notification templates and contact chains — is a critical gap in your incident governance that creates regulatory exposure for your customer.
Board Personal Liability
Under NIS2, management bodies of in-scope entities bear personal liability for cybersecurity measures. Even if your SaaS company is not directly in scope, your enterprise customers' boards are personally accountable for their vendor security decisions. A vendor that cannot demonstrate governance adequacy creates board-level liability risk for your customer — which makes you a liability, not an asset.
Two Paths for SaaS Companies Facing Enterprise Security Reviews
When enterprise security questionnaires arrive — and they will — most SaaS companies face a binary choice. Which path you take determines whether security is a competitive differentiator or a permanent drag on enterprise deal velocity.
Fire-Fighting Mode
- ✕Security questionnaires treated as unexpected crisis events
- ✕Documentation drafted ad hoc by engineering or legal teams
- ✕Different answers sent to different customers' questions
- ✕ISO 27001 certification promised but never resourced
- ✕Security assurance package: does not exist
Outcome: Extended sales cycles, auditor concerns, deal losses to certified competitors, and accumulated technical debt in security documentation.
Trust Centre Approach
- ✓ISO 27001 or SOC 2 certification in place or on a documented timeline
- ✓Security Assurance Package ready to share within hours of request
- ✓Pre-answered questionnaire library (SIG, CAIQ, bespoke)
- ✓Consistent, auditor-reviewed documentation across all customers
- ✓Certification roadmap communicated proactively during sales process
Outcome: Accelerated deal cycles, premium vendor positioning, competitive differentiation, and security functioning as a sales accelerator rather than a procurement obstacle.
Managing Your Upstream Vendors: The TPRM Requirement
Security governance is not only about demonstrating your own controls to customers. NIS2 and enterprise security questionnaires will also ask you to demonstrate that you manage the security of your own vendors — the cloud providers, SaaS tools, sub-processors, and API services that underpin your product.
The SolarWinds breach remains the canonical example: a compromised software update mechanism propagated a breach to thousands of downstream customers — including government agencies — none of whom had visibility into their vendor's internal security practices. Enterprise procurement teams know this story. They will ask whether you know what your vendors have access to, and what you do about it.
A Third Party Risk Management (TPRM) programme for a SaaS company does not need to be the complex apparatus of a bank. It needs to demonstrate that you have:
- 1An inventory of all vendors with access to your systems or customer data
- 2Criticality classifications for each vendor (what happens if they fail or are breached?)
- 3Documented due diligence: security questionnaires completed, certifications verified
- 4A sub-processor register that satisfies GDPR Art. 28 and customer due diligence requests
- 5A vendor offboarding process that includes confirmed data deletion
A vCISO can build this programme in weeks rather than months, using proven frameworks that satisfy enterprise questionnaires, ISO 27001 A.15 requirements, and GDPR sub-processor obligations simultaneously.
Is Security Blocking Your Enterprise Sales?
We offer a free 30-minute "Sales Blocker" review: we examine your current security posture against the questionnaires your enterprise prospects are sending, and identify exactly what is blocking your deals.
Book a Free Sales Blocker ReviewWhat a vCISO Delivers for a SaaS Business
Hiring a full-time CISO costs a Dutch SaaS company between €130,000 and €180,000 per year — before benefits, equity, and the six to twelve months typically required to find and onboard a qualified candidate. For an 80-person software company, that hiring decision competes directly with two additional engineers or a year of paid growth activity.
A fractional vCISO provides the same strategic security leadership at a fraction of the cost — typically €3,000 to €8,000 per month depending on scope — with the added advantage of deploying proven frameworks and cross-industry experience that an internal hire would take years to accumulate.
ISMS & ISO 27001 Roadmap
Gap assessment against ISO 27001 Annex A controls, ISMS design and documentation, internal audit preparation, and managed certification engagement with an accredited certification body. For most SaaS companies, initial certification is achievable within four to six months from a standing start.
Sales Enablement Package
Pre-answered questionnaire library covering SIG Lite, CAIQ, and bespoke enterprise questionnaires. Security Assurance Package for one-click sharing with prospects. Vendor-facing trust page content. Security review one-pager for procurement teams. Certification evidence summary and timeline.
Vendor Risk Programme
TPRM framework design, vendor criticality assessment, security due diligence questionnaires for your sub-processors, GDPR Art. 28 sub-processor register, and quarterly vendor monitoring process. Satisfies enterprise customer requirements, ISO 27001 A.15, and GDPR simultaneously.
Board & Regulatory Advisory
Board-level security awareness covering NIS2 supply chain obligations and personal liability. NIS2 and DORA gap assessment for indirect exposure. Incident response procedure including customer notification templates. Regulatory change monitoring and ongoing strategic security advisory.
Three Signs That Security Governance Is Becoming a Sales Problem
These are the indicators that consistently appear before a SaaS company's enterprise close rate starts to suffer. If any of these apply, the underlying cause is almost always the IT Ops vs IT Risk gap — and a vCISO is the fastest path to closing it.
Are enterprise prospects sending security questionnaires that take your team more than two days to answer?
A questionnaire that takes two days to answer is a questionnaire for which you do not have a governance programme. The answers are being assembled from scattered documentation, institutional memory, and best guesses. When an auditor asks follow-up questions, the inconsistencies become visible — and the deal slows or dies. A vCISO builds the documentation architecture that makes questionnaire responses accurate, consistent, and deliverable in hours.
Have you lost a deal or had a procurement process stall because of security review findings?
Security review failures at the procurement stage are often invisible in CRM reporting — they appear as "deal lost" or "no decision" rather than "failed security audit." If your close rate drops materially when enterprise procurement gets involved, the bottleneck is almost always governance documentation, not product capability. Enterprise buyers want your product. Their procurement teams are the obstacle — and governance solves it.
Does your incident response procedure include a step for notifying enterprise customers within 24 hours?
Your enterprise customers' NIS2 obligations require them to notify their competent authority within 24 hours of a significant incident — including incidents originating in their vendor chain. If a breach in your infrastructure affects their operations and you cannot provide timely, structured breach notification, you have created a regulatory problem for their board. That is not a vendor relationship that survives the incident.
Security Governance Is Not a Cost Centre — It Is a Distribution Channel
The most common objection to investing in security governance is that it is overhead — infrastructure that generates no revenue. This framing misunderstands what enterprise sales has become in a post-NIS2 environment.
ISO 27001 certification and a mature security governance programme are now prerequisites for enterprise contracts in regulated industries. They are the table stakes that determine whether your company appears on approved vendor lists, survives procurement reviews, and remains on preferred vendor registers when annual security reassessments happen.
The SaaS companies winning the largest enterprise contracts in the Netherlands are not winning because they have the best product. They are winning because they are the only vendor their customer's procurement team will sign off on. Security governance built that moat. A vCISO built the governance.
vCISO (Fractional CISO)
Strategic security leadership for SaaS companies and scale-ups — ISMS design, ISO 27001 roadmap, NIS2 advisory, and pre-built sales enablement at a fraction of a full-time CISO's cost.
Explore vCISO ServicesThird Party Risk Management
Build the TPRM programme that satisfies enterprise procurement teams, passes ISO 27001 A.15 requirements, and demonstrates the supply chain governance your NIS2-regulated customers require of their vendors.
View TPRM Services