each customer sends their own cyber questionnaire, how do I approach this cleverly

One supply chain file, ten fixed categories

The smart approach is not: fill in each list separately. It is: organise your answers once along the ten measures of Article 21(2) NIS2, and reuse them per customer. Bank, insurer and industrial customer ask almost word for word the same — only in different order and with different labels. The bank calls it "access control", the industrial customer calls it "identity & access management", but the answer comes from the same file section: is the access policy documented, including the management of business assets.

Once your file is complete for the ten categories — risk policy, incident handling, continuity, vulnerability management, supply chain security, testing, awareness, cryptography, access/MFA, and your own NIS2 status — each new list is mainly about recognising which question belongs to which category. Some questions cover two categories in one sentence, for example access policy together with multi-factor authentication. Split those in your file, not in your head again for each list.

Why those ten categories are the framework

Article 21(2) of the NIS2 Directive lists ten measures that an entity must take: from risk analysis policy to cryptography to access control. Almost every customer questionnaire — cyber form from a bank, security questionnaire from a tech supplier, ESG cyber section from an insurer — is its own translation of those same ten points, sometimes supplemented with ISO/IEC 27001 Annex A terminology because the drafter used that standard as a framework. Whoever builds their file on Article 21(2) thus recognises rapidly which Annex A control number or which customer question belongs to which file section. The Dutch Cybersecurity Act transposes these ten measures into national legislation from 15 August 2026 onwards, so the framework does not change — only the legal reference to which a customer then points.