my insurer wants a cybersecurity questionnaire, how do I fill that in

The insurer's questionnaire often covers the ten measures of NIS2

The questionnaire from an insurer is usually broader than a format from a customer who falls under the Cybersecurity Act themselves, but it does cover the same topics. Insurers use their own questionnaire because premium and coverage depend on risk, and those questions heavily rely on the ten measures from Article 21(2) of NIS2: risk analysis, incident handling, continuity, supply chain, vulnerabilities, testing, awareness, cryptography, access control and MFA. If you recognise that pattern, you can usually reuse the answers already in the chain file one-to-one, even if the insurer uses different wording than the previous questionnaire.

Two questions appear more frequently with insurers than with ordinary customer questionnaires: whether incident response has been exercised (not only whether there is a procedure for security incidents, but whether it has also been tested) and whether there is a concrete recovery plan with recovery time in addition to the general question about backups and contingency provisions. If you don't have that exercise or that concrete plan, then "no" is the correct answer — an insurer asks about practice, not intention. If an ISO 27001 certificate is missing, that is not a problem in itself: many insurers also accept the individual measures without certification.

Where the ten measures come from

The classification into ten measures is laid down in Article 21(2) of Directive (EU) 2022/2555 and can also be found in Annex A of ISO/IEC 27001, which elaborates the same control measures in more detail. Insurers often formulate their own questions more loosely than the directive text, but the underlying structure is the same ten subjects — this is why filling it in is faster if you know which question belongs to which measure.