customer asks how we respond to a cyberincident, how do I fill that in

Incident response plan: process, not just document

The question about the incident response plan concerns how the organization responds once a security incident is identified: who is alerted, who decides on escalation, how recovery is initiated, and how notification is made to customers or supervisors. A format often asks for the document itself — the incident response plan or procedure description — but most purchasing parties also implicitly test whether the plan has ever been used or tested. An answer "yes, there is a plan" without any exercise or actual incident having occurred is factually correct but weak; state that a procedure is in place and what you can demonstrate about it, such as a test report or an evaluation following a previous incident.

If a formally tested plan is missing, then "no" with a brief explanation is better than a completed "yes" without supporting documentation. Some customers specifically ask about notification deadlines to them as purchaser — that is a contractual agreement, not automatically the same deadline as a statutory notification obligation. Do not confuse the two in your answer: what you commit to your customer in an SLA is separate from what may need to be reported to a supervisor. This question often relates to the procedure for handling security incidents, and to the question of whether recovery and contingency are well arranged via back-ups and a contingency measure — a format sometimes splits this across multiple questions that belong together in the file.

Legal basis: article 21 paragraph 2 NIS2 and Annex A

Incident handling is named as a separate measure in article 21 paragraph 2 of the NIS2 Directive, alongside risk analysis and business continuity — it is one of the ten measures distinguished by the Directive. ISO/IEC 27001 elaborates on this in the control measures of Annex A, where incident management forms its own category with requirements for detection, response and evaluation. The Cybersecurity Act transposes this obligation into Dutch law and is expected to enter into force on 15 August 2026; until that date, alignment with the Directive itself is the starting point for substantiating an answer.