they ask who our CISO is but we don't have anyone with that title

No CISO needed, but a point of contact for security

You can usually simply enter "no" here without this being a shortcoming. None of the ten measures in Article 21(2) of the NIS2 Directive prescribes a job title. The Directive regulates obligations at the organizational level — governance, risk management, incident handling — not how you distribute these internally or what that role is called. A CISO ("Chief Information Security Officer") is one way to fulfill that, especially in larger organizations, but not a requirement. ISO/IEC 27001 is the same: Annex A calls for documented responsibilities for information security, not a specific title on the payroll.

What your customer actually wants to know is who is internally responsible and reachable in the event of an incident. In a smaller enterprise, this is often the owner themselves, the IT manager, or someone who handles security alongside another role. Enter that as an answer to the underlying question: name, job title, and if applicable how to reach that person. This also aligns with who responds if there is a security incident — that is usually the same person or team. Unsure whether your customer will accept "no CISO, but a responsible party"? Then do not confirm that answer blindly with "yes" — that is an assessment that belongs with the submitter, not with an automatically completed file.

Where this appears: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive lists ten categories of measures, including risk management, incident handling and access controls, but no role name. The Dutch Cybersecurity Act, which transposes this Directive and enters into force on 15 August 2026, follows the same approach. ISO/IEC 27001 Annex A calls for assigned responsibilities for information security in the section on organization of information security, not a job title. Want to check whether your enterprise itself falls under NIS2 obligations, that is a separate question that stands apart from this — for that, see whether the enterprise as an entity falls under the NIS2 Directive.