questionnaire asks how we respond to a ransomware attack

Ransomware falls under incident handling, not business continuity alone

The question about ransomware typically tests your response procedure, not your technology. Customers want to see that there is a documented process in place: detect, contain, recover, and report to the relevant parties. This is exactly the procedure for security incidents from Article 21(2)(b) of NIS2 — if you have described that procedure, use that text here, not a separate ransomware paragraph. A separate ransomware policy is therefore not a requirement; an incident procedure that names ransomware as a scenario is usually sufficient.

What is often asked separately is the recovery part: can you restart the service without paying the ransom. That belongs to back-ups and the contingency arrangement to restore service delivery — point (c) of the same list, business continuity and crisis management. If you have no recently tested back-up restore, then your answer to the ransomware scenario is effectively weak, even if your incident process looks good on paper. Answer this part only when you know whether the last restore test was performed and when.

Where this is precisely located: Article 21(2), points (b) and (c)

Article 21(2) of NIS2 lists ten measures that an entity must take; point (b) is incident handling, point (c) is business continuity including backup management and disaster recovery. A ransomware attack affects both: detection and response fall under (b), recovery without paying the attacker falls under (c). In the Dutch Cybersecurity Act — the Dutch implementation of NIS2, which enters into force on 15 August 2026 — these obligations appear for entities falling under the act; check in case of doubt whether the organisation itself falls under the NIS2 Directive or the national transposition thereof, as that determines whether this is an obligation or only a customer expectation. If you work with ISO 27001, the equivalent can be found in Annex A: A.5.24 to A.5.26 for incident management, A.5.29 and A.5.30 for continuity and disaster recovery. If you have formally documented neither, then the most honest answer is that you have an informal approach and no documented procedure — that is a different answer than "yes", and it is worth maintaining that distinction.