questionnaire asks about financial impact of previous cyber incidents, what do I enter

Financial impact is usually an estimate, not a financial statement figure

Enter what you can reasonably substantiate, and no more than that. Questionnaires asking about the financial impact of previous cyber incidents usually mean: is there a direct damage amount known (remediation costs, lost revenue, fines, ransom), and has that amount been realistically estimated or only estimated. If there has been no incident, the answer is simple: no incidents, so no damage amount. If there was an incident but the damage was never financially established, do not enter an amount you cannot substantiate — state that the impact has not been financially quantified, or refer to what is documented (for example remediation time or duration of downtime).

Pay attention to the scope of the question: some customers ask about incidents at your own organization, others about incidents in the entire supply chain of which you are part. The second affects security requirements for own suppliers — an incident at a supplier is not automatically "your" incident, unless it affected your service provision. If you have no documented incident register, that in itself is relevant information: it says something about the procedure for handling security incidents. Rather enter "no registered incidents" than guess at an amount.

Where this comes from: the reporting obligation and risk assessment of Article 21

The question about financial impact is linked to two things from Article 21(2) NIS2: the requirement that an entity records and assesses incidents (part of the ten measures), and the broader risk analysis obligation of Article 21(2)(a). ISO/IEC 27001 Annex A elaborates this through control measures around incident management, including documenting the consequences of an incident — not necessarily in euros, but documented. Under the Cybersecurity Act, which enters into force on 15 August 2026, reporting of significant incidents for entities covered by NIS2 becomes mandatory; whether that applies to your own organization depends on whether you yourself fall under the directive — see or whether the organization falls under the NIS2 directive. Until that law enters into force, financial quantification of damage is not a legal requirement, but it is something that customers want to see in their own risk assessment.