customer asks if we are insured against cyber damage

Cyber insurance is not itself a NIS2 measure

Cyber insurance does not appear in the list of Article 21(2) of the NIS2 Directive. The ten measures in that article concern risk analysis, incident handling, business continuity, supply chain security, access control policy and the like — an insurance policy is not a security measure but a way to cover residual financial damage. Yet the question comes up frequently in questionnaires from customers and insurers themselves, because a policy says something about how mature an organisation is in managing risk. With ISO/IEC 27001 you see the same: Annex A contains no control measure "insurance", but risk treatment — of which insurance is a recognised form alongside reduction, avoidance and acceptance — does belong to the management system.

Whether you must be insured thus does not depend on the ten measures themselves but on what your customer wants to know about it in practice: do you have financial cover if things go wrong, or do you mainly have the basics in order? These two questions are asked separately in most lists. Recognise the pattern: if the question is in a block about risk management, it often asks for the justification of the policy for risk analysis and information systems security. If the question stands alone, as a separate line about financial resilience, then a factual answer about the policy itself suffices — if you don't have one, then "no" is the right answer, even if that feels like a shortcoming.

Where this comes from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive lists the ten mandatory measures exhaustively; insurance does not appear there, nor implicitly under continuity — that concerns back-ups and disaster recovery arrangements to restore service delivery, not financial compensation afterwards. In Annex A of ISO/IEC 27001, risk treatment is an explicit part of the management system, and insurance is within it a recognised treatment option alongside technical and organisational measures. The Cyber Security Act, which transposes NIS2 in the Netherlands and comes into force on 15 August 2026, repeats the ten measures from the directive without adding an insurance obligation.