questionnaire asks how quickly we implement security updates

Patch policy falls under vulnerability management, not incident response

The question about the speed of updates and patches concerns the process for vulnerability management: how quickly do you report that a patch is available, and how quickly do you roll it out. That is a different process from incident response — installing a patch is preventive, handling an incident is reactive. Customers often ask about these separately in the same questionnaire, and it is wise to answer them separately as well: whoever conflates vulnerability management with incident response provides an answer that will not hold up under scrutiny.

Concrete evidence for this question is usually a timeline with deadlines per risk category: critical vulnerabilities within X days, high risk within Y days, and so on — plus a log showing that those deadlines are actually met. If you have not documented this, then "no" is the honest answer to this question, even if patches go quickly in practice; an undocumented practice is not a demonstrable process. The associated dossier section on a process for identifying and remediating vulnerabilities is the place to be able to submit that next time. Also pay attention to the scope of the question: some portals ask this only for systems that process customer data, others for the full IT environment including workstations — that makes quite a difference in what you need to be able to demonstrate.

Where this follows from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive names vulnerability management and the handling of known weaknesses as one of ten mandatory measures for entities falling under the Directive; the Cybersecurity Act transposes this into Dutch legislation. Whether that obligation applies to the undertaking itself depends on or whether the organization falls under the NIS2 directive — but even without that obligation, a larger customer often asks for this anyway, as part of their own supply chain assessment. ISO/IEC 27001 elaborates on this further under the control measures in Annex A, where patch management and technical vulnerability management reappear as a separate control point.