our insurer wants to fill in a cybersecurity questionnaire for the policy

Cyber policy questionnaire often covers the same ten measures

The questionnaire from an insurer largely overlaps with the ten measures from Article 21(2) of NIS2: risk analysis, incident handling, continuity, supply chain, vulnerability management, testing, awareness, cryptography, access control and MFA. Insurers ask this not because the undertaking falls under NIS2 — often it does not — but because these ten points have become the common standard for cyber risk. Recognition of that structure makes completion faster: each question can be traced back to one of the ten, even if the insurer uses different wording.

For supporting documents: a question about access control usually wants an answer about access control and asset management, regardless of whether multi-factor authentication is also in place — insurers often ask those two separately from each other, even if in practice the answer is connected. If a piece is missing, then "no, not yet" is a valid answer on the questionnaire; insurers weigh that in the premium, not in the acceptance itself. An ISO 27001 certificate speeds up completion considerably, because the Annex A controls largely overlap with these ten measures — whoever is certified can refer per question to the corresponding control number instead of writing a new explanation.

Origin of the ten measures and the overlap with ISO 27001

The ten measures are listed in Article 21(2) of Directive (EU) 2022/2555; the Dutch Cybersecurity Act transposes that directive and is expected to enter into force on 15 August 2026, but the measures themselves are already being used by insurers before that date as a reference framework. ISO/IEC 27001 Annex A elaborates the same subjects further in concrete control measures, which explains why a certificate often immediately answers multiple questions on the list.