questionnaire asks how quickly we install patches, what do I enter

Patch deadline falls under vulnerability management policy, not incident response

The question about update or patch speed belongs to the vulnerability management process, one of the ten measures under Article 21(2) NIS2. Customers usually ask this with a concrete deadline: "within 14 days for critical patches" or "within 30 days for high risk". If your organisation does not apply a fixed deadline per severity level, do not blindly enter one of those numbers — describe what actually happens, for example that patches are prioritised based on a CVSS score or vendor advice, and that critical vulnerabilities are rolled out outside the regular maintenance cycle.

Evidence for this is usually a patch management policy that includes the deadlines applied per risk class, plus an extract from the patch register or ticket system demonstrating that those deadlines are actually met. If the latter is missing, a description of the process without measurements is better than an entered deadline you cannot substantiate. This topic overlaps with the process for identifying and remediating vulnerabilities — often that is the same question in a different questionnaire, so check whether you already have an answer in the chain file before you start again.

Where this appears in ISO 27001 and Article 21

In ISO/IEC 27001, patch management falls under the control measures in Annex A that relate to technical vulnerabilities; auditors typically ask for a documented deadline and evidence of compliance over the last period, not just the policy on paper. NIS2 itself does not set a fixed patch deadline — Article 21(2) names vulnerability management as a mandatory measure, but leaves the implementation to the entity. If you expect that the Cyber Security Act will prescribe a concrete deadline after it comes into force on 15 August 2026, check that upon publication of the final text; that is not yet established at this time. If you do not yet have your own numbered deadlines per risk class, this also affects the question of whether there is a policy for risk analysis and the protection of information systems, because patch prioritisation is usually based on that risk analysis.