I keep receiving almost the same questionnaire from different customers, should this be faster

Five lists, one source: the ten measures of Article 21

Yes, that can be faster, because those five lists are almost certainly asking about the same underlying framework. The customers approaching you — banks, larger buyers, insurers — are all rewriting the same ten measures from Article 21(2) of the NIS2 Directive in their own portal formats. One calls it "vulnerability management", another "vulnerability policy", a third asks about "patch management procedures" — it's about the process for identifying and remediating vulnerabilities. The same applies to access policy, incident response, continuity and the rest: different wording, the same underlying measure.

The work that remains is finding the one answer that fits all five formulations, and checking per list whether the answer is still current — not re-examining five times what exactly is being asked. A fixed set of source documents (policies, procedures, evidence) linked to each of the ten measures makes that a matter of copying and adapting to the format, instead of formulating from scratch each time. Where customers often ask separately, and where it therefore makes no sense to keep reconstructing, is whether the organisation itself falls under the NIS2 directive — that answer does not change per customer.

Why those ten measures appear everywhere

Article 21(2) of the NIS2 Directive lists ten categories of measures that entities covered by the Directive must take: from risk analysis and incident handling to cryptography and access control. Because banks and large buyers base their own due diligence questionnaires on this Article — sometimes directly, sometimes via ISO/IEC 27001 Annex A, which largely translates the same subjects into control measures — the content of the questions recurs, even if the order, grouping and terminology differ per portal. The Dutch Cybersecurity Act transposes this Directive into national legislation and enters into force on 15 August 2026; until that date the underlying framework does not change, so the overlap between this year and next year remains largely intact.