filling in this security questionnaire takes me far too much time every time

Always the same ten topics, in different guises

That's almost always due to one thing: every customer translates the same ten measures from Article 21(2) NIS2 into their own words and their own order. One portal asks "do you have an incident response process", another "describe your procedure for security incidents" — it's the same question as is there a procedure for handling security incidents?. Without one central file, you look up that answer ten times a year, in ten different formulations.

The time isn't in answering, it's in finding the evidence. Which policy document, which version, which certificate — looking that up and reformulating the answer to the format of that specific customer, that's the whole day. Questions about multi-factor authentication, about access control and asset management and about security requirements for own suppliers come back in almost every list, just differently organized. Once someone for each question type documents what the actual answer is and where the evidence is, they only need to recognize which of the ten topics is meant afterwards — and that's minutes of work, not a day.

Traceable to the same ten measures

Article 21(2) of Directive (EU) 2022/2555 sets out the ten measures that almost every security questionnaire — whether from a bank, an insurer or a large customer — refers back to directly or indirectly: from risk management and incident handling to cryptography and access control. Anyone applying ISO/IEC 27001 recognizes those same topics in the control measures of Annex A, which explains why a questionnaire on "information security" and one on "NIS2 compliance" largely ask about the same facts. The Dutch Cybersecurity Act, which transposes this Directive by 15 August 2026, does not change that core structure — the questions customers are already asking now will therefore largely remain the same questions after that date.