the questionnaire asks whether we have a crisis plan for a cyber incident

Crisis plan falls under business continuity, not incident response

The question about a "crisis plan in case of a hack" actually asks about two things at once in practice, and the answer depends on which of the two you have. The first is a continuity plan: how the service delivery continues to run or how you restore it, regardless of what exactly went wrong. The second is an incident response plan: who does what as soon as a hack is discovered, who is informed, how is the incident contained. Many entrepreneurs have the second but not the first, or vice versa, and then tick "yes" to a question that actually asks about both.

If you only have an informal plan — a few agreements that everyone knows but that are not documented anywhere — then "no" is usually the most honest answer, with an explanation that the approach exists but is not formally documented. If you have a continuity plan without a separate cyber component, check whether it explicitly names a cyber incident as a scenario; if not, that is a gap that the customer often flags. This topic is closely related to whether there are backups and an emergency provision to restore service delivery and to whether there is a procedure for handling security incidents — answer those two first, then this question often falls into place by itself.

Where this recurs in Article 21(2) NIS2

Article 21(2) of Directive (EU) 2022/2555 mentions "business continuity, such as backup management and disaster recovery, and crisis management" as one of the ten mandatory measures — so continuity and crisis management are listed together there, not as two separate requirements. Annex A of ISO/IEC 27001 has a comparable control measure for ICT readiness in case of business disruption. The Dutch Cybersecurity Act, which transposes this obligation, enters into force on 15 August 2026.