how do I enter that employees can report a security incident

Internal reporting channel is the evidence, not an intention

This question is about the reporting channel itself: can employees report an incident internally, and does that actually happen. That is different from the question of whether the organization records or handles incidents — that belongs to the procedure for handling security incidents. Here the customer specifically wants to know whether there is an easily accessible, well-known route through which an employee can raise something: an email address, a ticket system, a name on the intranet. The evidence is therefore not the procedure as a whole, but the concrete channel plus something that shows that employees know about that channel — a screenshot of the intranet, a passage from the onboarding document, or a training slide.

If you haven't documented that separately, then "no" or "partially" is the honest answer, even if there is an incident procedure that is only used by the IT team. Do not fill in "yes" based on the procedure alone; the question tests awareness and accessibility, not just process. If there is awareness training that covers the reporting channel, that is often the strongest evidence — check that against training in basic practices for cyberhygiene, because those two answers must be consistent with each other. If it doesn't match, that will stand out faster in an audit sample than a single missing piece of evidence.

Where this comes from: Article 21(2) and Annex A

This requirement comes from Article 21(2) of the NIS2 Directive, where incident handling is one of the ten mandatory measures; the Cybersecurity Act implements this into Dutch law as of 15 August 2026. ISO/IEC 27001 elaborates on this in Annex A down to the level of reporting channels and awareness, and customers working with an ISO questionnaire often ask literally for that Annex A control point. If the organization itself is certified, this evidence is usually already available — see the company's ISO 27001 certificate for how to make that demonstrable.