my cyber insurer sends an extensive questionnaire, what must I fill in

Cyber insurers ask for the same ten measures as NIS2

An extensive security questionnaire from a cyber insurer largely overlaps with the ten measures in Article 21(2) of the NIS2 Directive: risk analysis, incident handling, business continuity, supply chain security, vulnerability management, cryptography policy, access control and MFA. Insurers do not use this structure because they must report under the Directive, but because it is a useful risk indicator for premium and coverage. If you recognize this structure in the questionnaire, you can largely draw on what you have already documented for other clients.

Where it becomes more difficult: insurers often ask somewhat more concretely than a client who only wants to know "do you have an incident procedure". For example, they want to know whether there is a procedure for handling security incidents including reporting deadlines and escalation paths, or they follow up on the effectiveness of security measures — so not only whether the policy exists, but whether it has ever been tested. If you do not have evidence, answer factually: "not yet formalized" or "in development" is better than a yes you cannot substantiate in a claim.

ISO 27001 as a shorter route through the questionnaire

If you have an ISO 27001 certificate, it covers a large part of the questionnaire at once, because the Annex A measures align almost one-to-one with what insurers ask. Mention the certificate explicitly where asked whether the company is ISO 27001 certified and refer to the corresponding audit report for the underlying measures if the insurer asks for it — this often saves a separate explanation for each question.

Where this follows from: Article 21(2) and Annex A

The ten categories of measures are set out in Article 21(2) of Directive (EU) 2022/2555 (NIS2); the Dutch transposition follows via the Cybersecurity Act, which enters into force on 15 August 2026. The comparable structure of control measures is set out in Annex A of ISO/IEC 27001. Insurers are not bound by either — the questionnaire is their own risk tool — but the overlap in structure is no coincidence: both sources describe what is considered baseline security in practice.