I don't know the answer to a question, can I enter no

"No" is an answer about a measure, not about an unknown fact

Filling in "No" when you don't know the answer is not the right solution. "No" is a valid answer to the question of whether a measure is in place — for example that there is no MFA requirement, or no documented incident procedure. But it is not a valid answer to the question of whether you know something. These are two different things, and a questionnaire usually does not make that distinction explicit.

The wisest thing to do is first to check whether the answer is actually known somewhere in the organization, just not by you. A question about security requirements for own suppliers can for example be with procurement, and a question about multi-factor authentication with IT. Only if the answer is truly not documented anywhere is there factually no measure to confirm — and then "No" is at least correct, instead of a guess that turns out to be wrong later.

The ten measures of Article 21 ask for a fact, not an assessment

The questionnaires that result from NIS2 are based on the ten measures of Article 21(2) of Directive (EU) 2022/2555. Each measure — from risk management to access policy — is a yes/no question about an existing practice, not about an estimate. The same applies to the control measures in Annex A of ISO/IEC 27001, to which many customer formats refer. An answer that has no source in the supply chain file is therefore not presented as "yes" in our system: it remains open until there is a fact behind it. This is also why a question such as whether the organisation itself falls under the NIS2 directive is treated separately from the substantive measures — it is a different kind of fact, with a different kind of evidence.