customer asks about our recovery time after a system outage, what do I enter there

Recovery time is not an RTO/RPO figure but a process description

What is usually asked here is not a single figure but whether a continuity process exists: is there an emergency provision, has it been tested and how quickly is the service resumed. So do not enter a concrete recovery time if it is not documented anywhere — for example in a BCP (business continuity plan) or DRP (disaster recovery plan) with a defined RTO (recovery time objective) and RPO (recovery point objective). If that is not in place, then "no, not yet formally documented" is the honest answer, possibly with an explanation that back-ups do exist but without a tested recovery time.

Many customers combine this question with a question about the incident procedure itself: is there a process to detect and escalate an outage before recovery can even begin. So also check the procedure for handling security incidents, because without that process a recovery time cannot be solidly established anyway. If you have defined an RTO/RPO, the evidence is usually the BCP/DRP document itself, or a test report from the most recent failover or restore test. If that test report is missing, it is better to answer "no" than an untested assumption.

Where this follows from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive explicitly mentions "business continuity, such as backup management and disaster recovery" among the ten measures as a mandatory part of an entity's security policy. ISO/IEC 27001 elaborates on this in Annex A under the control measures for availability and continuity of information processing facilities. To determine whether your organisation itself is obligated to have this process, it is first relevant whether you fall under the directive — check this via whether the organisation itself falls under the NIS2 directive. The Dutch Cybersecurity Act transposes this requirement, entering into force on 15 August 2026; until that date customers often already ask about it, in anticipation of their own supply chain obligations.