questionnaire asks about our recovery time after a cyber incident

Recovery time falls under continuity, not under incident response

This question falls under the business continuity measure of Article 21(2) NIS2, not under incident handling. The customer wants to know how long the service can be down after a cyber incident before critical processes are running again — the list often asks for this as RTO (recovery time objective) and sometimes also for the RPO (recovery point objective, how much data loss is acceptable). These are not loose figures you make up on the spot; they should come from the continuity plan that already exists, or otherwise from the recovery plan associated with the backup provision.

If you have not formally documented those values, then "to be determined" is the correct answer here — do not enter an estimate that you cannot substantiate. Specifying an RTO without a tested recovery plan behind it is a promise that will be held against you at the next disruption. First check whether there are backups and a backup facility to restore the service; if they exist, the recovery time is usually stated there or can be derived from a tabletop exercise. If this provision is still missing, this is one of the ten measures from Article 21 paragraph 2 that still needs to be implemented.

Where this comes from: Article 21(2) and Annex A

Article 21 paragraph 2 sub c of NIS2 explicitly names business continuity, including backup management and disaster recovery, as one of the ten mandatory measures; under the Cybersecurity Act — the Dutch implementation, which enters into force on 15 August 2026 — the same classification applies to entities falling under the Act. Those applying ISO/IEC 27001 will find the corresponding control measure in Annex A under the information security continuity category. Note: the recovery time itself is not stated as a figure in either source — the organisation establishes this standard itself on the basis of its own risk analysis. If it is not yet clear whether this subject is mandatory for the organisation itself, this can be determined via the question of whether the organisation itself falls under the NIS2 Directive or the national transposition thereof.