questionnaire asks whether we have reported incidents to a supervisory authority

Reporting obligation applies only if you yourself fall under NIS2

This question is only relevant if your undertaking itself is a NIS2 entity — essential or important. If you do not fall under that category, the answer is usually "not applicable" and you can note that as well, with a brief explanation why. If you are uncertain about that status, that should first be clarified via or whether the organization falls under the NIS2 directive — the answer to this question depends directly on that.

If you do fall under NIS2, the question turns on whether you have actually reported incidents that meet the reporting criteria to the CSIRT or the competent supervisory authority, within the set timeframes (initial report, interim report, final report). If you have done so, "yes" can be substantiated with the reporting confirmation or the incident register as evidence. If you simply had no reportable incident in the requested period, then "no" is the factually correct answer — that is not a shortcoming, and you can also explain it that way in the free text field. It becomes problematic only if there was an incident that met the criteria and no report was made; that is a fact that your file should simply reflect, not something to rephrase. This question is moreover related to the procedure for handling security incidents": without a functioning procedure there is usually also no conclusive reporting process.

Where this stems from: article 21 paragraph 2 sub b and the Cyber Security Act

The reporting obligation itself is not in article 21 paragraph 2 — that article describes the ten measures, including under b incident handling as a control measure. The actual reporting obligation with timeframes is separately provided for in the directive and is implemented for the Netherlands in the Cyber Security Act, which enters into force on 15 August 2026. Until that date there is no Dutch statutory reporting obligation based on NIS2; what a customer asks in a questionnaire now is often an advance on that obligation or an ISO 27001 question about incident recording in Annex A.