questionnaire asks if management is involved in cybersecurity

Board involvement is a separate NIS2 obligation, distinct from the ten measures

This question is not about technology but about governance: is management itself engaged in cybersecurity, or has it been completely delegated to IT. Article 21(2) of NIS2 contains the ten measures themselves, but Article 20 of the directive additionally requires that governing bodies approve risk management measures and oversee their implementation, and that board members receive training to assess cyber risks. This is therefore a separate point on the questionnaire: not "which measures do you have", but "does the top know about and approve this".

As evidence, usually a minutes excerpt is accepted in which the board has established or evaluated the security policy, an organogram showing reporting lines to management, or an agenda item from a periodic management meeting on cyber risks. If that is missing, then "no" is the honest answer here — a supplier who completes this without documentation runs the risk that the customer will come back to it later. This question is often related to the question is the effectiveness of security measures tested periodically, as testing without management follow-up is only a partial answer for a customer. Also relevant is whether your company itself falls under the NIS2 directive, because then this is not only a question from your customer but your own legal obligation as of 15 August 2026, when the Cybersecurity Act enters into force.

Where this comes from: Article 20 alongside Article 21 NIS2

Article 20 of Directive (EU) 2022/2555 governs the liability and involvement of governing bodies, separate from the ten substantive measures in Article 21(2); ISO/IEC 27001 has no literal equivalent in Annex A but does require demonstrable involvement of senior management through the core requirements of the standard (clause 5, leadership), which is often provided as separate evidence alongside the Annex A measures.