must we report a security incident from last year to our customer

An old incident belongs in the questionnaire, not in a separate reporting channel

Yes, a security incident from last year you complete if the question asks about incidents or about their handling — even if the incident itself has already been closed. The question in most customer questionnaires is not about a current threat, but about whether a procedure exists and whether it works. A resolved incident from last year is evidence for that rather than a risk: it shows that the procedure for handling security incidents in practice has been completed, from detection to closure.

This is therefore different from a legal reporting obligation to a supervisory authority — which has its own deadlines and its own recipients, and those deadlines have long since passed if the incident is from last year. Your customer's questionnaire is not a reporting point; it is an accountability question. Answer it based on what is currently established: is there a procedure, was it applied, have improvements been implemented following the incident? If the latter is missing, then "no" or "partly" is just as valid an answer as "yes" — as long as it matches what is documented in the chain file.

Where this comes from: Article 21(2) and Annex A

Article 21 paragraph 2 of the NIS2 Directive lists incident handling as one of the ten mandatory measures, alongside for example risk analysis and the protection of information systems and business continuity policy. ISO/IEC 27001 elaborates on this in Annex A into control measures that call for registration, response and evaluation of incidents — a closed file from last year fits perfectly there as example material. The Dutch Cybersecurity Act, the Dutch transposition of NIS2, enters into force on 15 August 2026 and regulates the legal reporting obligation to the government; that is a different process than the accountability that a customer requests in his own questionnaire.