why do I need to answer so many questions with my insurance advisor

Insurers are now also asking about cyber and continuity

The extensive questionnaire from your intermediary almost always comes from the insurer behind it, not from the intermediary itself. Insurers offering coverage for cyber risks or business damage now routinely ask for more information than in the past: what technical measures are in place, is there a contingency plan, how are suppliers handled. This is risk assessment for the policy, not a legal obligation that directly applies to your business — although the questionnaire may contain topics from NIS2 or similar regulations, because insurers use these frameworks as reference points.

Specifically, the list usually falls into three sections. One: basic company data, often already known from the Business Register. Two: technical and organisational measures, with questions about access control, patch management and logging often drawing on the structure of ISO/IEC 27001 Annex A or the ten measures in Article 21(2) of the NIS2 Directive — even if your business does not fall within the scope of that Directive, insurers recognise that structure. Three: continuity — whether there is a plan to continue business operations in the event of a serious disruption. If you don't have such a document, then "no" is the honest answer; an insurer often does not ask for the plan itself, but records whether it exists.

Basic data come from the chain file, the rest does not

Questions about legal form, Business Register number and number of employees follow from the data that under the Trade Register Act 2007 are already recorded, and these are usually already in your chain file. Questions about specific security measures or a continuity plan are not a legal obligation but an insurance technical risk assessment; if the answer is not available, that is a factual matter and not an error.