questionnaire asks whether our company has taken out cyber insurance

Cyber insurance is not a replacement for the ten measures

Cyber insurance is a financial provision against damage from an incident, not evidence of security level. The question about cyber insurance is usually separate from the questions about the ten measures under Article 21(2) of NIS2 — which concern risk analysis, incident handling, continuity and access. A customer asking this mainly wants to know whether financial damage from an incident is covered, not whether security is in order. This distinction matters for the answer: "no" to this question says nothing about the answer to the question of whether there is a procedure for security incidents or to the question about backups and contingency measures.

If the organisation has no cyber insurance, then "no" is the factually correct answer — there is no reason to bend that towards "partial" or "under review". Some policies cover only certain types of damage (for example business interruption, but not reputational damage or fines); if that is relevant to the questionnaire, it usually appears in a separate explanatory question and not in the yes/no question itself. Note that the policy is in the name of the correct entity: insurance of the parent company does not automatically cover the subsidiary filling in the questionnaire.

Why this is separate from the NIS2 measures

The ten measures of Article 21(2) of the NIS2 Directive mention no insurance requirement; they describe technical and organisational measures such as risk management, cryptography and access control. Annex A of ISO/IEC 27001 also has no control measure that makes insurance mandatory. Cyber insurance can be useful as a supplement to the measures laid down in the risk analysis policy but legally and normatively they are two separate matters.