do I need to report a security incident from last year in the questionnaire

An old incident usually does belong in the answer

Yes, in most cases you report an incident from last year now as well, if the question in the list is not explicitly limited to a specific period. Questionnaires typically ask about the situation in general: has an incident occurred, and how was it handled. A small incident from last year falls under that, even if it has since been resolved and has no further consequences. If the question does include a period — "in the past twelve months" or "this calendar year" — then that is decisive, and you only include what falls within that period.

More important than the incident itself is often how you responded to it. A customer asking about incidents actually wants to know if there is a process behind it: has it been flagged, has it been resolved, has it been learned from. This aligns with a procedure for handling security incidents. If you have such a procedure and it was followed, then a small incident from last year is no problem to report — it actually shows that the process works. If you are unsure whether details are too sensitive to share, use the confidentiality button with the answer instead of modifying the answer itself.

Why this is separate from the reporting obligation in the Cybersecurity Act

This question in a questionnaire is different from the statutory reporting obligation to a supervisory authority. Article 21 paragraph 2 of the NIS2 Directive lists the management of incidents as one of the ten mandatory measures for entities falling under the directive; the Cybersecurity Act implements this as the Dutch transposition, with an obligation to report to the competent authority. Whether this reporting obligation applies to the undertaking depends on whether it itself falls under the directive — this can be checked with the question of whether the undertaking falls under the NIS2 Directive. The question in a customer questionnaire is separate from that: it does not ask about a statutory report, but about transparency towards the customer about how mature the incident process is.