I don't understand a technical question from the questionnaire, who can answer this

Reduce the question to one of the ten measures

A technical question from a questionnaire is almost always a translation of one of the ten measures from Article 21(2) of NIS2, or of a control measure from Annex A of ISO/IEC 27001. The customer's portal often uses its own wording — "how is your network segmentation arranged" or "what encryption standard do you use for data at rest" — but the underlying question is known. It is worthwhile to first determine which category the question falls under: is it about access, encryption, vulnerabilities, or the supply chain. Once that category is established, the question can usually be answered with existing documentation, even if the exact term is new.

If in doubt about the precise technical implementation — which protocol, which key length, which scan frequency — the IT department or external administrator is the appropriate party, not the commercial or legal contact person who receives the list. If you regularly encounter the same technical questions about encryption, you can record that as a standard answer for the topic or whether there is a policy on cryptography and encryption, so that question does not have to be worked out from scratch every time. The same applies to questions about multi-factor authentication or access control: these are separate questions in the list, but substantively the same subject repeatedly reformulated.

Where the ten measures come from

Article 21(2) of Directive (EU) 2022/2555 lists ten categories of measures, from risk analysis to cryptography to human behaviour within the organisation. Annex A of ISO/IEC 27001 elaborates on similar subjects in concrete control measures, which explains why an audit question and a customer question often amount to the same thing, even if the wording differs. The Cybersecurity Act transposes Article 21 into Dutch law and is expected to enter into force on 15 August 2026; until that date, the directive itself is the starting point for anyone wishing to determine which measure a question falls under.