questionnaire asks whether the business continuity plan has been tested what answer should I provide

Tested means here: exercised, not just written down

No, a plan that exists only on paper and has never been exercised does not meet what is being asked here. The question about a tested business continuity plan concerns crisis management and recovery after incidents, one of the ten measures from Article 21 paragraph 2 of NIS2. Testing can take place at multiple levels: a tabletop exercise where the team discusses a scenario, a technical failover test where an actual switch to an emergency facility takes place, or a full simulation with recovery from backup. What the customer specifically wants to see is usually not in the question itself but in the accompanying guidance — if it says "proof of last test", a standalone policy document is not enough.

If the company has a continuity plan but it has not yet been tested, the most honest answer is "no" with an explanation of the planned test date, if one exists. Filling in "yes" because the plan is there, while no one has ever exercised it or actually restored the backup, is the kind of answer that still comes to light in a later audit or incident. This subject directly concerns back-ups and emergency provision to restore service delivery — that is where what counts as evidence for the continuity side of the same question.

Where this comes from: Article 21 and the testing obligation

Article 21 paragraph 2 of the NIS2 Directive names "business continuity, such as management of back-ups and emergency recovery, and crisis management" as one of the ten mandatory measures; ISO/IEC 27001 elaborates on this in Annex A control measures on continuity management, in which testing and evaluation are standard parts of the measure, not a separate step. Whether tested continuity policy is also mandatory for the organisation itself according to the Dutch Cybersecurity Act depends on whether the organisation itself falls within the scope of application — see for this whether the organisation itself falls under the NIS2 directive. Regardless of that obligation, a customer often asks this simply because an untested plan in practice is an assumption, not a certainty.