my customer asks for supporting documents with the questionnaire, what must I provide

Evidence belongs to the answer, not to the question as a whole

There is no fixed list of "evidence for cyber answers" — the evidence depends on which of the ten measures from Article 21(2) of the NIS2 Directive the customer is asking about. If he asks about access control, then an excerpt from the access policy is appropriate, not the entire information security policy. If he asks about incident response, then often a process description with escalation lines suffices, not an incident log with details. When organizing this, think of the categories that also appear in the risk analysis policy, the procedure for handling security incidents and the requirements for own suppliers come back: each asks for a different type of substantiation.

If you do not have the evidence document — for example because the policy exists but has never been documented — then "no" with a brief explanation is the honest answer, not a reference to a document that does not exist. An ISO 27001 certificate covers multiple questions at once, but only if the scope of that certificate actually covers the aspects the customer is asking about; otherwise it creates false certainty that will resurface during an audit. Therefore, first check whether the certificate applies to the requested area before submitting it as evidence.

Where this follows from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive names the ten measures that a customer usually asks about in detail — from risk management to access policy to supplier security — and each measure has its own type of evidence, not one overarching document. ISO/IEC 27001 Annex A contains the control measures that are often used as a checklist to determine which evidence belongs to which question; a certificate against that standard is therefore not a replacement for the underlying documents, but a confirmation that they have been reviewed. The Cybersecurity Act, the Dutch transposition of NIS2, comes into force on 15 August 2026 and contains the same structure — for those collecting evidence now, aligning with that structure is therefore time well spent.