what do I have to enter about burglary protection for business insurance

Physical security and information security are two separate questions

The insurer's questionnaire usually asks about two separate matters that are often confused: the physical security of the premises (locks, alarm, cameras, fencing) and access management (who has keys, how is a break-in reported). For the premises itself, the insurer wants concrete characteristics: the locking system (SKG classes are often mentioned), whether there is a connected alarm system and at which control centre, whether there is camera surveillance and how long footage is retained, and whether there is outdoor lighting or fencing. These are factual questions about installations, not estimates — you fill in what is installed and working, not what you would like to have installed.

If you do not have ISO 27001 certification, that is not in itself a problem for this questionnaire: Annex A concerns information security (access to systems, password policy, logging) and not break-in security of premises. Insurers sometimes ask about this anyway, especially if the premises also contains server rooms or sensitive data storage. If the answer in the supply chain file is missing, the system does not automatically provide a yes — you then get an empty field with the question, and you fill it in yourself or leave it open for enquiry with the facilities manager. Supporting documents that insurers often want to see are the installation certificate from the alarm company and a maintenance certificate for the locking system; you upload these separately, apart from the textual answers.

Why this is separate from cyber standards

Break-in security of premises does not fall under any of the broad reporting frameworks in the supply chain file — not under the VSME basic module of EFRAG and not under the ten measures of article 21(2) of NIS2, which concern network and information security. These are insurance-related questions that vary per policy condition, so the system recognizes them at question level from previous lists, not from a legal source. Data that is already established, such as the registered address what the security relates to, comes through automatically so you do not have to type it separately.