the questionnaire asks whether we have had a cyber incident in recent years

An incident question is about facts, not about image

The question whether you have had a cyber incident in recent years calls for a factual answer: yes or no, and if yes usually with a brief explanation of nature, impact and resolution. There is no right or wrong answer — a "yes" with proper handling is more credible to many clients than an unmotivated "no" from a supplier who cannot demonstrate anything else about their security. What matters: can you substantiate the answer?

If there was an incident, the evidence is not the incident itself but how it was handled: was it reported, investigated and followed up according to a fixed procedure? That is precisely what the procedure for handling security incidents asks, and clients often combine this question with those two. If there was no incident, then "no" is the answer, possibly with a reference to detection measures that demonstrate this — see the process for identifying and remediating vulnerabilities. Without an incident register or log, "no" is still a valid answer, but then without underlying evidence; you can mention this in the explanation instead of inventing evidence that does not exist.

Why this falls under the ten measures

Incident handling is one of the ten concrete measures that Article 21(2) of Directive (EU) 2022/2555 (NIS2 Directive) lists as part of an entity's security policy. In the Dutch transposition via the Cybersecurity Act — which enters into force on 15 August 2026 — the same requirement applies to entities falling under that act. This makes a question about previous incidents in practice often an indirect test of whether the organisation has an incident process, not only of the incident itself. Those applying ISO/IEC 27001 recognise the same theme in Annex A, under the control measures for "information security incident management".